CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Solutions Architect - Associate Exam Question Walkthrough
Master a key AWS exam question on private subnet access to S3 and avoid common pitfalls.
Instances in a private subnet only need to reach Amazon S3. The team wants to avoid NAT Gateway data processing charges for this traffic. What should they implement?
A. A larger NAT Gateway
B. An S3 Gateway VPC endpoint
C. An Internet Gateway on the private subnet
D. A second NAT instance
Think before you scroll
Consider the requirements carefully. The goal is to allow private subnet instances to access S3 without incurring extra charges. Focus on the options that facilitate direct access to S3 without going through the NAT Gateway.
The answer
The correct option is B. An S3 Gateway VPC endpoint. This solution allows the instances in the private subnet to access S3 directly over the AWS network, eliminating data processing charges associated with NAT Gateway usage.
Why the other options lose
A. A larger NAT Gateway: This option does not solve the problem. Increasing the size of the NAT Gateway does not eliminate the data processing charges. It simply allows for more traffic, which is not required here.
C. An Internet Gateway on the private subnet: A private subnet cannot have an Internet Gateway. This option is invalid and does not facilitate direct access to S3 from a private subnet.
D. A second NAT instance: Similar to option A, adding another NAT instance will still incur NAT processing charges. It fails to provide a cost-effective solution for accessing S3 from a private subnet.
The concept behind it
The underlying principle here is about optimizing traffic routing in AWS. By using VPC endpoints, you can establish a private connection to AWS services like S3 without needing an Internet Gateway or NAT device. This approach is not only cost-effective but also enhances security by keeping traffic within the AWS network.
Exam trap to remember
Remember: VPC endpoints can save costs and improve security when accessing AWS services from private subnets. Always consider them for direct service access.