SAA-C03 Question 519
Single answerA company is running a web application in a VPC that needs to communicate with an S3 bucket in the same region to store user uploads. The company wants to minimize data transfer costs while maintaining secure access to the S3 bucket. Which solution is the MOST cost-optimized and secure?
- A
Configure a NAT gateway in the public subnet to allow the web application to access the S3 bucket.
- B
Use an S3 VPC endpoint to enable private communication between the application and the S3 bucket.
- C
Enable public access on the S3 bucket and access it directly using its public endpoint.
- D
Set up an EC2 instance as a proxy server in the VPC to forward traffic to the S3 bucket.
Show answer and explanation
Correct answer: B
Explanation
The S3 VPC endpoint allows traffic between the VPC and S3 to remain within the AWS network, eliminating internet data transfer costs and enhancing security by avoiding public access. This makes it the most cost-optimized and secure solution for this scenario.
- A. Incorrect.
Configuring a NAT gateway would allow the application to access S3, but NAT gateways incur additional data transfer and hourly costs, making this option less cost-optimized.
- B. Correct.
Using an S3 VPC endpoint creates a private connection between the VPC and S3, avoiding data transfer charges to the internet and ensuring secure access. This is the most cost-optimized and secure solution.
- C. Incorrect.
Enabling public access on the S3 bucket would reduce security and could result in additional internet data transfer costs, which is not recommended.
- D. Incorrect.
Using an EC2 instance as a proxy server might work but would introduce additional operational complexity and EC2 instance costs, making it less cost-efficient.