These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
SAA-003
EC2 instances in a private subnet need to access Amazon S3. You want to avoid communication over the internet and avoid the cost of a NAT Gateway. Which configuration is the most appropriate?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: B. Create an S3 Gateway VPC Endpoint and associate it with the target subnet route table.
Explanation
An S3 Gateway VPC Endpoint allows access from a private subnet to S3 over the AWS network. There is no NAT Gateway fixed cost either.
Per-choice explanations
A. Create a NAT Gateway and route 0.0.0.0/0 from the private subnet route table to the NAT Gateway.
Incorrect. A NAT Gateway incurs the cost the requirement asks to avoid.
B. Create an S3 Gateway VPC Endpoint and associate it with the target subnet route table.
Correct. A Gateway VPC Endpoint for S3 provides low-cost private access.
C. Assign a public IP to the EC2 instance and access S3 from there.
Incorrect. Assigning a public IP routes traffic over the internet and conflicts with the requirement.
D. Attach an Internet Gateway directly to the private subnet.
Incorrect. An Internet Gateway attaches to a VPC and is not directly associated with a private subnet.
Practical Use
There are two paths to access S3 from EC2 in a private subnet: via a NAT Gateway (over the internet to the public S3 endpoint) and via a VPC Endpoint (over the AWS internal network). S3 and DynamoDB offer Gateway-type VPC Endpoints, and the Gateway Endpoint itself incurs no additional charges. Because the NAT Gateway is billed by hourly unit price and data processing volume, simply offloading S3 traffic to a VPC Endpoint can lead to large cost savings in configurations with heavy data transfer. Gateway Endpoints and Interface Endpoints (PrivateLink-based, with ENIs placed per AZ) are different things with different billing models. Gateway Endpoints are limited to the two services S3 and DynamoDB and are free; most other AWS services use Interface Endpoints (ENI hourly billing and data processing billing). At design time, the practical baseline is to apply an endpoint policy that allows only operations on specific buckets to close any path to unintended buckets. Because incidents where some subnets accidentally go through the internet due to missing route table settings happen easily, verify that all relevant route tables in the target VPC are associated with the endpoint. On SAA-C03, a Gateway VPC Endpoint is the correct answer for requirements such as "access S3 from a private subnet at low cost" or "avoid the fixed cost of a NAT Gateway." Advanced exams also ask about distinguishing Interface and Gateway Endpoints, narrowing access with endpoint policies, and service integration through PrivateLink.