These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
SAA-026
A Lambda function inside a VPC accesses DynamoDB. To avoid the fixed cost of a NAT Gateway, which configuration is the most appropriate?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: D. Create a DynamoDB Gateway VPC Endpoint
Explanation
A DynamoDB Gateway VPC Endpoint lets resources inside the VPC access DynamoDB privately and avoids the fixed cost of a NAT Gateway.
Per-choice explanations
A. Create a NAT Gateway in each AZ
Incorrect. NAT Gateways incur fixed costs.
B. Attach an Internet Gateway directly to Lambda
Incorrect. There is no configuration that attaches an Internet Gateway directly to Lambda.
C. Place the DynamoDB table in a public subnet
Incorrect. DynamoDB is not a service placed inside VPC subnets.
D. Create a DynamoDB Gateway VPC Endpoint
Correct. It removes the need for a NAT Gateway for DynamoDB access.
Practical Use
S3 and DynamoDB are special in AWS in that they support Gateway VPC Endpoints, which let resources inside a VPC reach the service over the AWS backbone. The Gateway Endpoint itself is free, and intra-region data transfer is not charged. For workloads where a VPC-attached Lambda or EC2 calls DynamoDB, this can significantly reduce cost compared with routing through a NAT Gateway. NAT Gateways are billed by the hour (tens of dollars per month per AZ) and by data processed, so the higher the VPC Lambda traffic, the bigger the benefit of using an Endpoint. In terms of design, Gateway Endpoints work by adding a prefix list to route tables. A common pitfall is failing to associate the Endpoint with the route tables of all relevant subnets in the target VPC, leaving some Lambda functions still routed through the NAT Gateway. Endpoint Policies can restrict access to specific DynamoDB tables, blocking unintended table access at the VPC level. Gateway Endpoints are only available for S3 and DynamoDB; other services (Secrets Manager, KMS, SQS, and so on) use Interface Endpoints, which are based on PrivateLink and incur ENI charges. On SAA-C03, requirements such as "VPC Lambda accessing DynamoDB," "avoid the fixed cost of a NAT Gateway," and "connect over a private path" point to a Gateway VPC Endpoint. Distractors such as adding more NAT Gateways, attaching an Internet Gateway directly to Lambda, or placing DynamoDB in a public subnet either increase cost, do not exist as configurations, or contradict the service's characteristics, and can be ruled out. The distinction with Interface Endpoints and restricting access via Endpoint Policies are also asked in higher-level exams.