SAA-C03 Question 48
Single answerA company is deploying an application in a VPC that needs to securely communicate with an Amazon S3 bucket in the same region. The company wants to ensure that the traffic does not traverse the public internet. What is the most appropriate solution?
- A
Use an S3 VPC endpoint to establish private connectivity between the VPC and Amazon S3.
- B
Use an internet gateway to route traffic from the VPC to Amazon S3.
- C
Enable AWS Direct Connect to establish a private connection between the VPC and Amazon S3.
- D
Attach a NAT gateway to the VPC for accessing Amazon S3 privately.
Show answer and explanation
Correct answer: A
Explanation
To ensure private communication between a VPC and Amazon S3, an S3 VPC endpoint is the best solution. It uses AWS PrivateLink to keep the traffic within the AWS network, avoiding the public internet. Other options like an internet gateway or NAT gateway do not meet the requirement of keeping the traffic private.
- A. Correct.
This is the correct solution. An S3 VPC endpoint (a type of interface endpoint) allows secure, private connectivity between a VPC and Amazon S3 without traversing the public internet.
- B. Incorrect.
This is incorrect. An internet gateway allows resources in the VPC to access the public internet, which would expose the traffic to the public internet rather than keeping it private.
- C. Incorrect.
This is incorrect. AWS Direct Connect is used to establish a private network connection between an on-premises environment and AWS, not between a VPC and S3.
- D. Incorrect.
This is incorrect. A NAT gateway allows private resources in a VPC to access the internet, but traffic to Amazon S3 would still traverse the public internet without an S3 VPC endpoint.