An analytics team runs EC2 instances in a private subnet with no NAT gateway and no internet gateway. They need the instances to read and write objects in an S3 bucket in the same Region, using only private connectivity, at no additional hourly charge. Which solution meets this requirement?
- An interface VPC endpoint (AWS PrivateLink) for S3
- A gateway VPC endpoint for S3
- A NAT gateway routed to an internet gateway
- A VPC peering connection to a public S3 endpoint
Correct answer: B. A gateway VPC endpoint for S3
A gateway VPC endpoint for S3 is a target you add to a route table so that traffic destined for S3 in the same Region travels over the AWS network instead of the internet, and AWS documentation lists gateway endpoints as 'not billed', unlike interface endpoints. Because the instances only need same-Region access and no internet gateway or NAT is available, a gateway endpoint satisfies the requirement at no extra hourly cost, making the second option correct. An interface VPC endpoint (AWS PrivateLink) also keeps traffic off the internet and works for S3, but it is billed hourly plus per-GB data processing charges, and it is primarily needed for on-premises or cross-Region access rather than same-Region in-VPC traffic, so it doesn't meet the 'no additional charge' requirement here. A NAT gateway would route traffic out through an internet gateway to reach S3's public endpoint, which is unavailable in this subnet and also incurs its own hourly and data processing charges. VPC peering connects two VPCs directly and has no role in reaching a public AWS service endpoint like S3, so it does not apply.
Source: AWS S3 documentation: AWS PrivateLink for Amazon S3 — gateway endpoints are not billed and route S3 traffic within a Region over the AWS network