SOA-C02 Question 239
Single answerYou are managing an application hosted in a private subnet within a VPC. The application needs to securely access Amazon S3 for storing and retrieving data without using the public internet. As a SysOps Administrator, which solution would you implement to meet this requirement?
- A
Create a VPC endpoint for Amazon S3 in the VPC and configure the application to use the endpoint.
- B
Set up a NAT gateway in the public subnet to enable private subnet access to the internet.
- C
Create a VPN connection between the VPC and your corporate data center to access S3.
- D
Enable Systems Manager Session Manager to manage access to the private subnet and connect to S3.
Show answer and explanation
Correct answer: A
Explanation
To securely access Amazon S3 from a private subnet, the best approach is to use a VPC endpoint for S3. This allows private communication between the VPC and S3 without exposing traffic to the public internet. Solutions like NAT gateways or VPNs are not required in this scenario, and Systems Manager Session Manager is not relevant to connecting to S3.
- A. Correct.
This is the correct solution. A VPC endpoint for Amazon S3 allows secure and private connectivity between resources in a VPC and S3 without traversing the public internet.
- B. Incorrect.
This is incorrect. While a NAT gateway can provide internet access to resources in a private subnet, it is not the best solution for securely accessing S3 without using the public internet.
- C. Incorrect.
This is incorrect. A VPN connection is used for securely connecting on-premises networks to a VPC, but it is not necessary for accessing S3 from within a VPC.
- D. Incorrect.
This is incorrect. Systems Manager Session Manager provides secure shell access to instances in a private subnet but is unrelated to accessing S3.