SAA-C03 · Question #5
A company runs an AWS Lambda function in private subnets in a VPC. The subnets have a default route to the internet through an Amazon EC2 NAT instance. The Lambda function processes input data and…
The correct answer is C. Provision a gateway endpoint for Amazon S3 in the VPC. Update the route tables of the subnets. Gateway Endpoint for Amazon S3: A VPC endpoint for Amazon S3 allows you to privately connect your VPC to Amazon S3 without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Provisioning the Endpoint: Navigate to the VPC Dashboard…
Question
A company runs an AWS Lambda function in private subnets in a VPC. The subnets have a default route to the internet through an Amazon EC2 NAT instance. The Lambda function processes input data and saves its output as an object to Amazon S3. Intermittently, the Lambda function times out while trying to upload the object because of saturated traffic on the NAT instance's network The company wants to access Amazon S3 without traversing the internet. Which solution will meet these requirements?
Options
- AReplace the EC2 NAT instance with an AWS managed NAT gateway.
- BIncrease the size of the EC2 NAT instance in the VPC to a network optimized instance type
- CProvision a gateway endpoint for Amazon S3 in the VPC. Update the route tables of the subnets
- DProvision a transit gateway. Place transit gateway attachments in the private subnets where the
How the community answered
(27 responses)- A4% (1)
- B7% (2)
- C70% (19)
- D19% (5)
Explanation
Gateway Endpoint for Amazon S3: A VPC endpoint for Amazon S3 allows you to privately connect your VPC to Amazon S3 without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Provisioning the Endpoint: Navigate to the VPC Dashboard. Select "Endpoints" and create a new endpoint. Choose the service name for S3 (com.amazonaws.region.s3). Select the appropriate VPC and subnets. Adjust the route tables of the subnets to include the new endpoint. Update Route Tables: Modify the route tables of the subnets to direct traffic destined for S3 to the newly created endpoint. This ensures that traffic to S3 does not go through the NAT instance, avoiding the saturated network and eliminating timeouts. Operational Efficiency: This solution minimizes operational overhead by removing dependency on the NAT instance and avoiding internet traffic, leading to more stable and secure S3 interactions.
Community Discussion
No community discussion yet for this question.