Q98 — AWS SAA-C03 Ch.12

Question 98 of 100 | ← Chapter 12

Q898. A company runs an application on Amazon EC2 instances in a private subnet. The application needs to store and retrieve data in Amazon S3 buckets. According to regulatory requirements, the data must not travel across the public internet.What should a solutions architect do to meet these requirements MOST cost-effectively?

Correct Answer: D. Deploy an S3 gateway endpoint to access the S3 buckets.

Explanation

To meet the requirement of ensuring that the data does not travel across the public internet when accessing Amazon S3 buckets from EC2 instances in a private subnet, the most cost-effective solution is as follows:D. Deploy an S3 gateway endpoint to access the S3 buckets.An S3 gateway endpoint is a VPC endpoint that allows you to access Amazon S3 from within your VPC without traversing the public internet. By deploying an S3 gateway endpoint, the traffic between your EC2 instances in the private subnet and Amazon S3 stays within the Amazon network, meeting the regulatory requirements while minimizing data transfer costs.Option A suggests deploying a NAT gateway to access the S3 buckets. However, a NAT gateway is used for outbound internet connectivity from private subnets and does not provide a direct solution for accessing S3 without using the public internet. Using a NAT gateway would still result in data transfer across the public internet, which does not meet the regulatory requirements.Option B suggests deploying AWS Storage Gateway to access the S3 buckets. AWS Storage Gateway is primarily used for hybrid cloud storage integration and may introduce additional complexity and cost that is not necessary for this scenario. It is not the most cost-effective solution for accessing S3 from EC2 instances in a private subnet.Option C suggests deploying an S3 interface endpoint to access the S3 buckets. However, there is no such thing as an S3 interface endpoint. The correct term is an S3 gateway endpoint, which was mentioned in Option D.In summary, to meet the requirement of ensuring that the data does not travel across the public internet when accessing Amazon S3 buckets from EC2 instances in a private subnet, deploying an S3 gateway endpoint (Option D) is the most cost-effective and suitable solution.