SAA-C03 Question 46
Single answerA company is running a workload in a VPC and requires private connectivity to AWS services such as Amazon S3 and Amazon DynamoDB. The solution should ensure that traffic does not traverse the public internet and should minimize the need for managing additional infrastructure such as NAT gateways. Which solution meets these requirements?
- A
Create VPC endpoints for Amazon S3 and Amazon DynamoDB.
- B
Use a NAT gateway to route traffic to Amazon S3 and Amazon DynamoDB.
- C
Establish a VPN connection between the VPC and AWS to access Amazon S3 and Amazon DynamoDB privately.
- D
Use an internet gateway to route traffic to Amazon S3 and Amazon DynamoDB.
Show answer and explanation
Correct answer: A
Explanation
VPC endpoints provide private connectivity between resources in a VPC and AWS services such as Amazon S3 and DynamoDB, ensuring that traffic does not traverse the public internet. This solution minimizes additional infrastructure requirements and costs compared to options like NAT gateways. Using internet gateways or VPN connections would not achieve the required private connectivity to AWS services.
- A. Correct.
Correct. VPC endpoints (specifically Gateway Endpoints for Amazon S3 and DynamoDB) enable private connectivity to these services without crossing the public internet.
- B. Incorrect.
Incorrect. While a NAT gateway could allow resources in private subnets to access AWS services, it routes traffic through the public internet and incurs additional costs.
- C. Incorrect.
Incorrect. A VPN connection is used to connect on-premises networks to AWS, not for private connectivity to AWS services within a VPC.
- D. Incorrect.
Incorrect. An internet gateway enables resources in a VPC to access the public internet, which does not meet the requirement of avoiding public internet traffic.