Q90 — AWS SAA-C03 Ch.12

Question 90 of 100 | ← Chapter 12

Q890. A company runs a web application on multiple Amazon EC2 instances in a VPC. The application needs to write sensitive data to an Amazon S3 bucket. The data cannot be sent over the public internet.Which solution will meet these requirements?

• A. Create a gateway VPC endpoint for Amazon S3. Create a route in the VPC route table to the endpoint. ✓
• B. Create an internal Network Load Balancer that has the S3 bucket as the target.
• C. Deploy the S3 bucket inside the VPCreate a route in the VPC route table to the bucket.
• D. Create an AWS Direct Connect connection between the VPC and an S3 regional endpoint.

Correct Answer: A. Create a gateway VPC endpoint for Amazon S3. Create a route in the VPC route table to the endpoint.

Explanation

To meet the requirement of securely writing sensitive data to an Amazon S3 bucket from EC2 instances in a VPC without sending the data over the public internet, the following solution can be implemented:A. Create a gateway VPC endpoint for Amazon S3. Create a route in the VPC route table to the endpoint.Amazon VPC endpoints enable private connectivity between a VPC and supported AWS services without requiring internet gateway, NAT device, VPN connection, or AWS Direct Connect. By creating a gateway VPC endpoint for Amazon S3, the EC2 instances in the VPC can securely access S3 over the AWS network backbone without traversing the public internet.To implement this solution, you would perform the following steps:Create a gateway VPC endpoint for Amazon S3 in the VPC where the EC2 instances are deployed. This establishes a private connection between the VPC and S3.Update the VPC route table to include a route to the gateway VPC endpoint for Amazon S3. This ensures that traffic destined for S3 from the EC2 instances is directed to the endpoint.By configuring the gateway VPC endpoint and updating the route table, the EC2 instances in the VPC can securely write sensitive data to the S3 bucket without the need for internet access.Option B suggests creating an internal Network Load Balancer (NLB) with the S3 bucket as the target. However, NLB is primarily used for load balancing incoming traffic to multiple targets within a VPC, and it does not provide a direct solution for securely writing data to an S3 bucket.Option C suggests deploying the S3 bucket inside the VPC. However, Amazon S3 is a regional service and does not support deploying buckets directly within a VPC.Option D suggests creating an AWS Direct Connect connection between the VPC and an S3 regional endpoint. While Direct Connect can provide a dedicated private connection to AWS services, it is generally used for connecting on-premises networks to AWS rather than for accessing S3 from a VPC.In summary, to securely write sensitive data to an Amazon S3 bucket from EC2 instances in a VPC without sending the data over the public internet, creating a gateway VPC endpoint for Amazon S3 and updating the VPC route table to the endpoint (Option A) is the appropriate solution.