A company has a VPC with public and private subnets. They have a web application running on EC2 instances in an Auto Scaling group in the public subnets. The application needs to read and write data to an S3 bucket. They want to ensure that traffic to S3 does not traverse the internet. The security team also requires that all traffic to S3 be logged. The current setup uses a NAT Gateway for outbound internet access. However, the NAT Gateway is a single point of failure and costs are high. They want to replace it with a more cost-effective and highly available solution that meets the logging requirement. What should they do?

Question

Accepted Answer

Create a Gateway VPC Endpoint for S3, enable VPC Flow Logs, and remove the NAT Gateway after verifying no other outbound internet traffic is needed.. A Gateway VPC Endpoint for S3 is free of charge, highly available by design (within a Region), and does not require a NAT Gateway for S3 access. Traffic to S3 remains within the AWS network. VPC Flow Logs can be enabled to capture traffic to the endpoint for logging purposes. After verifying that no other outbound internet traffic is required, the NAT Gateway can be removed to reduce costs and eliminate the single point of failure.

Option A is incorrect because setting up a VPN connection to on-premises does not provide a direct path to S3; traffic would still need to traverse the internet or a partner network, and it adds unnecessary complexity and cost. Option C is incorrect because an Interface VPC Endpoint for S3 incurs hourly charges and data processing fees, making it less cost-effective than a Gateway Endpoint. Option D is incorrect because it keeps the NAT Gateway, which the company wants to replace due to cost and single point of failure concerns; the goal is to remove the NAT Gateway if no other outbound traffic is needed.

Answer

Set up a VPN connection to an on-premises data center and route S3 traffic through the VPN, enabling VPC Flow Logs.

Answer

Create an Interface VPC Endpoint for S3 in each Availability Zone, enable VPC Flow Logs, and remove the NAT Gateway.

Answer

Create a Gateway VPC Endpoint for S3, enable VPC Flow Logs, and keep the NAT Gateway for other outbound traffic.

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

ANS-C01 Network Security, Compliance and Governance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question