SAA-C03 Question 47
Single answerA company has deployed an application in a private subnet within a VPC. The application needs to securely access an Amazon S3 bucket in the same region without using a public internet connection. What is the most cost-effective solution to achieve this?
- A
Configure a NAT Gateway in the public subnet and route traffic to the S3 bucket through it.
- B
Set up a VPC endpoint for Amazon S3 and update the route table of the private subnet to route traffic to the endpoint.
- C
Use an Internet Gateway and attach it to the VPC, allowing the application to access S3 over the internet.
- D
Establish a VPN connection from the private subnet to the Amazon S3 service.
Show answer and explanation
Correct answer: B
Explanation
The most cost-effective and secure way for an application in a private subnet to access an Amazon S3 bucket in the same region is by setting up a VPC endpoint for Amazon S3. This allows the traffic to remain within the AWS network, avoiding the need for an internet connection or a NAT Gateway, which would incur additional costs.
- A. Incorrect.
This option is not the most cost-effective solution because a NAT Gateway incurs hourly charges and data processing fees. Additionally, it routes traffic through the internet, which is not required for S3 in the same region.
- B. Correct.
This is the correct option. A VPC endpoint for Amazon S3 allows the application to securely access S3 without leaving the AWS network and avoids the need for an internet connection or NAT Gateway. It is also cost-effective since it eliminates NAT Gateway charges.
- C. Incorrect.
An Internet Gateway is not suitable for private subnets as it requires resources to have public IP addresses. This approach exposes traffic to the internet, which is unnecessary and less secure for accessing S3.
- D. Incorrect.
This option is not applicable because a VPN connection is typically used to connect an on-premises network to a VPC, not for accessing AWS services like S3 from within a VPC.