SAA-C03 · Question #533
A company runs its legacy web application on AWS. The web application server runs on an Amazon EC2 instance in the public subnet of a VPC. The web application server collects images from customers…
The correct answer is A. Create a gateway VPC endpoint for the S3 bucket that has the necessary permissions for the. To route S3 traffic privately from within a VPC, AWS provides Gateway VPC Endpoints for Amazon S3. These allow private connectivity to S3 without traversing the public internet or requiring an Internet Gateway. "A gateway endpoint enables you to privately connect your VPC to…
Question
A company runs its legacy web application on AWS. The web application server runs on an Amazon EC2 instance in the public subnet of a VPC. The web application server collects images from customers and stores the image files in a locally attached Amazon Elastic Block Store (Amazon EBS) volume. The image files are uploaded every night to an Amazon S3 bucket for backup. A solutions architect discovers that the image files are being uploaded to Amazon S3 through the public endpoint. The solutions architect needs to ensure that traffic to Amazon S3 does not use the public endpoint. Which solution will meet this requirement?
Options
- ACreate a gateway VPC endpoint for the S3 bucket that has the necessary permissions for the
- BMove the S3 bucket inside the VPC. Configure the subnet route table to access the S3 bucket
- CCreate an Amazon S3 access point for the Amazon EC2 instance inside the VPC. Configure the
- DConfigure an AWS Direct Connect connection between the VPC that has the Amazon EC2
How the community answered
(33 responses)- A91% (30)
- B3% (1)
- C6% (2)
Explanation
To route S3 traffic privately from within a VPC, AWS provides Gateway VPC Endpoints for Amazon S3. These allow private connectivity to S3 without traversing the public internet or requiring an Internet Gateway. "A gateway endpoint enables you to privately connect your VPC to supported AWS services such as Amazon S3 and DynamoDB without requiring an Internet Gateway, NAT device, or public IP." Why A is correct: Gateway VPC endpoints route S3 traffic internally within the AWS network. Improves security and data privacy while reducing exposure to the public internet. Requires only a simple route table modification and IAM policy configuration. Why other options are incorrect: B: S3 is a regional service; you cannot "move" it inside a VPC. C: Access points do not change the routing path; still uses S3 endpoints. D: AWS Direct Connect is for hybrid environments, not intra-AWS private connectivity.
Community Discussion
No community discussion yet for this question.