AWS Certified Advanced Networking – Specialty (ANS-C01)Network ImplementationMedium
A media company uses Amazon S3 to store large video files accessed by EC2 instances in private subnets. To optimize costs and improve security, the company wants to ensure that all traffic to S3 from these EC2 instances remains within the AWS network and does not traverse the public internet. Which VPC endpoint type should the network engineer implement?
- AGateway Endpoint for S3
- BInterface Endpoint for S3
- CVPC Peering connection to an S3-enabled VPC
- DAWS PrivateLink for S3
Show answer & explanationAnswer & explanation
Correct answer: A. Gateway Endpoint for S3
A Gateway Endpoint for S3 provides reliable connectivity to S3 from within a VPC without requiring an Internet Gateway, NAT device, VPN connection, or AWS Direct Connect. It is a route table entry that directs traffic to S3 over the AWS network, offering both cost savings and enhanced security.
Why the other options are wrong
- B. Interface Endpoints (powered by PrivateLink) are available for many AWS services and S3, but Gateway Endpoints are the cost-optimized and simpler solution specifically for S3 (and DynamoDB) when only internal AWS network access is needed.
- C. VPC Peering does not provide direct access to S3; it connects two VPCs. S3 is a public service, and a VPC endpoint is needed to access it privately from a VPC.
- D. AWS PrivateLink powers Interface Endpoints. While S3 now supports Interface Endpoints, Gateway Endpoints are the traditional, cost-free, and often sufficient solution for S3 access from within a VPC.
VPC Gateway Endpoint
A VPC endpoint that allows you to privately connect your VPC to supported AWS services (S3 and DynamoDB) without requiring an Internet Gateway or NAT device.
- Supports Amazon S3 and DynamoDB only
- Route table entry as a target
- Free of charge (data transfer costs apply for S3/DynamoDB)
- Enhances security by keeping traffic within AWS network
Memory trick: Gateway for S3/Dynamo, Interface for everything else PrivateLink.