SOA-C02 Question 237
Single answerYour company has deployed an application on an Amazon EC2 instance within a private subnet in a VPC. The application requires access to an Amazon S3 bucket in the same AWS Region to store logs. For compliance reasons, the company mandates that no traffic should traverse the public internet. How can you configure private connectivity between the EC2 instance and the S3 bucket to meet the requirement?
- A
Create a VPC endpoint for Amazon S3 and configure the instance's route table to use the endpoint.
- B
Enable NAT Gateway in the public subnet and configure the route table of the private subnet to use the NAT Gateway.
- C
Use AWS Systems Manager Session Manager to establish connectivity between the EC2 instance and S3.
- D
Configure a VPN connection between the private subnet and Amazon S3.
Show answer and explanation
Correct answer: A
Explanation
To ensure private connectivity between the EC2 instance and Amazon S3 without traversing the public internet, you should use a VPC endpoint for S3. VPC endpoints enable private connections between resources within a VPC and supported AWS services, ensuring compliance with the requirement to avoid public internet traffic.
- A. Correct.
This is the correct answer. A VPC endpoint for Amazon S3 allows private connectivity between resources in your VPC and S3 without traffic going through the public internet.
- B. Incorrect.
This is incorrect because a NAT Gateway still routes traffic through the public internet, which violates the compliance requirement.
- C. Incorrect.
This is incorrect because Systems Manager Session Manager is used to manage EC2 instances, not to establish private connectivity to Amazon S3.
- D. Incorrect.
This is incorrect because VPN connections are typically used for connecting on-premises networks to a VPC, not for private connectivity to AWS services like S3.