AWS Certified Solutions Architect – ProfessionalDesign for New SolutionsEasy
A financial institution is building a new application that processes highly sensitive customer data. The application needs to connect to various AWS services (e.g., S3, DynamoDB, SQS) from within a private VPC without traversing the public internet. The solution must ensure maximum security and compliance. Which AWS networking component should be used to establish this private connectivity?
- ADirect Connect
- BVPC Endpoints
- CNAT Gateway
- DInternet Gateway
Show answer & explanationAnswer & explanation
Correct answer: B. VPC Endpoints
VPC Endpoints allow instances in a VPC to privately connect to supported AWS services without requiring an internet gateway, NAT device, VPN, or AWS Direct Connect connection. This ensures that sensitive data does not traverse the public internet, meeting the security and compliance requirements.
Why the other options are wrong
- A. AWS Direct Connect provides private connectivity from on-premises networks to AWS, but the question is about connecting from within a VPC to other AWS services, not from on-premises.
- C. A NAT Gateway allows instances in a private subnet to connect to the internet or other AWS services, but traffic still traverses the public internet, which is not allowed for highly sensitive data.
- D. An Internet Gateway allows public internet access to/from the VPC, which explicitly violates the requirement of not traversing the public internet for sensitive data.
VPC Endpoints
A feature that enables private connectivity to supported AWS services and VPC endpoint services powered by AWS PrivateLink, ensuring that network traffic does not leave the Amazon network.
- Connects VPC to AWS services privately.
- Traffic stays within the Amazon network.
- No internet gateway, NAT device, VPN, or Direct Connect needed.
- Enhances security and compliance for sensitive data.
Memory trick: VPC Endpoints are private tunnels, keeping sensitive data off the public roads.