AWS Certified Advanced Networking – Specialty (ANS-C01)Network ImplementationMedium
A solutions architect is designing a network for a new application in AWS. The application will be deployed in a private subnet and needs to access several AWS services (e.g., S3, DynamoDB) without traversing the public internet. Furthermore, the company policy dictates that all traffic to these AWS services must remain within the AWS network for security and compliance reasons. Which type of VPC endpoint should be configured to meet these requirements?
- AVPC Peering connection to a service VPC.
- BGateway Load Balancer Endpoint.
- CInterface Endpoint (powered by AWS PrivateLink).
- DGateway Endpoint.
Show answer & explanationAnswer & explanation
Correct answer: D. Gateway Endpoint.
Gateway Endpoints are specifically designed for privately connecting your VPC to Amazon S3 and DynamoDB. They are routing table entries that act as a target for traffic destined to these services, ensuring the traffic remains within the AWS network and doesn't traverse the public internet.
Why the other options are wrong
- A. VPC Peering connects two VPCs, but it's not a mechanism for privately accessing AWS services like S3 or DynamoDB; these services are external to a VPC.
- B. Gateway Load Balancer Endpoints are used for integrating third-party virtual network appliances, not for direct private access to AWS services like S3 or DynamoDB.
- C. Interface Endpoints (PrivateLink) are for connecting to a wider range of AWS services and services hosted by other AWS customers or partners. While they offer private connectivity, Gateway Endpoints are the specific and more cost-effective solution for S3 and DynamoDB.
VPC Gateway Endpoint
A VPC Gateway Endpoint provides reliable and scalable private connectivity to Amazon S3 and DynamoDB from your VPC without requiring an Internet Gateway or NAT device.
- Supports Amazon S3 and DynamoDB only.
- Implemented as a route table entry in your VPC.
- Traffic remains within the AWS network, improving security and compliance.
Memory trick: Gateway Endpoint: The special private door to S3 and DynamoDB.