ANS-C01 VPC Endpoint for S3 Practice Question

A company wants to restrict access to an Amazon S3 bucket so that only traffic from a specific AWS Direct Connect virtual interface (VIF) can access it. Which combination of steps should the company take?

⚠ Common exam trap

A common trap is to think that a bucket policy with an IP address condition can restrict traffic to a Direct Connect VIF, but Direct Connect VIFs use private IPs, not public IPs. Another trap is using network ACLs, which are stateless and cannot restrict based on the source being a specific VIF.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a VPC endpoint for S3 with a VPC endpoint policy that allows access only from the VPC, and configure the VPC route table to route S3 traffic through the Direct Connect VIF.

Option B. To restrict access to an S3 bucket to only traffic from a specific Direct Connect VIF, you can create a VPC endpoint for S3 and attach a VPC endpoint policy that allows access only from the VPC. Then, configure the VPC route table to route traffic destined for S3 through the Direct Connect VIF, ensuring that only traffic coming through that VIF can reach the endpoint. Option A is incorrect because the Direct Connect VIF does not have a public IP address; it uses private IPs. Option C is incorrect because network ACLs are stateless and cannot enforce path-specific restrictions; also they operate at the subnet level, not for specific services like S3. Option D is incorrect because Direct Connect VIFs do not have public IP addresses; they use private IPs and traffic goes through private virtual interfaces.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Attach an S3 bucket policy that denies access unless the source IP is the public IP address of the Direct Connect VIF.
Why it's wrong here
Direct Connect VIFs use private IP addresses, not public IPs; the source IP would be from the on-premises network, not the VIF.
✓
Create a VPC endpoint for S3 with a VPC endpoint policy that allows access only from the VPC, and configure the VPC route table to route S3 traffic through the Direct Connect VIF.
Why this is correct
This ensures that S3 traffic must traverse the VPC endpoint, and the route table forces traffic through the Direct Connect VIF, restricting access to that path.
✗
Create a network ACL that allows S3 traffic only from the Direct Connect CIDR block and associate it with the VPC subnet connected to the VIF.
Why it's wrong here
Network ACLs are stateless and not designed to enforce traffic source path; they also do not directly restrict S3 bucket access.
✗
Configure the Direct Connect VIF with a public IP address and use an S3 bucket policy that allows access only from that IP address.
Why it's wrong here
Direct Connect VIFs do not have public IP addresses; they use private IPs or BGP prefixes.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

ANS-C01 VPC Endpoint for S3 Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question