How to Use VPC Endpoints to Access S3 and Secrets Manager Without a NAT Gateway
A company runs an application in private subnets (no inbound internet). The application must access Amazon S3 and AWS Secrets Manager endpoints without routing through the public internet and without exposing the instances to NAT gateways due to cost. Security requirements also state that only the required VPC traffic should be allowed to reach AWS services.
Which architecture best satisfies these requirements?
Quick Answer
This design works because it pairs each AWS service with the correct endpoint type for how that service is accessed. Amazon S3 is one of the small number of services supported by VPC gateway endpoints, which route traffic privately through the VPC route table at no additional cost, a good fit here since the requirement explicitly calls out avoiding NAT gateway expense. Secrets Manager, on the other hand, is reached through an interface endpoint, which provisions an elastic network interface with a private IP inside the subnet using AWS PrivateLink; because it's ENI-based, it can have a security group attached to it, which is exactly the control needed to restrict inbound traffic to only the application subnets and satisfy the requirement that only required VPC traffic reach the service. A single endpoint type could not have satisfied both needs at once, since gateway endpoints don't support security groups and not every service offers a gateway endpoint option. When you see a private-subnet architecture that needs to reach multiple AWS services without a NAT gateway while also restricting which traffic can reach them, check each service individually: use a gateway endpoint where one exists for cost and simplicity, and layer an interface endpoint's security group wherever finer network-level control is required.
⚠ Common exam trap
It's easy for candidates to assume all AWS service endpoints require a NAT gateway or internet gateway for private subnet access, overlooking the cost-effective and secure alternative of VPC endpoints (gateway and interface) that keep traffic within the AWS network.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a VPC gateway endpoint for S3 and an interface VPC endpoint for Secrets Manager; keep instances in private subnets and configure security group rules attached to the endpoints to allow inbound traffic only from the application subnets.
It uses a VPC gateway endpoint for S3 and an interface VPC endpoint for Secrets Manager, both of which allow private subnet instances to access these AWS services without traversing the public internet or requiring a NAT gateway. The security group rules attached to the interface endpoint restrict inbound traffic to only the application subnets, satisfying the security requirement of allowing only required VPC traffic. This architecture avoids NAT gateway costs and keeps instances isolated from inbound internet traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place instances in private subnets but use NAT gateways so traffic to S3 and Secrets Manager goes through the internet; restrict security groups to instance-to-instance only.
Why it's wrong here
NAT still routes traffic through the internet path and contradicts the cost and private-connectivity requirement. Restricting instance-to-instance rules does not prevent public service access through NAT.
When this WOULD be correct
If the question required internet access for other purposes (e.g., software updates) and cost was not a constraint, using NAT gateways in private subnets would be appropriate for outbound traffic to AWS services.
- ✓
Add a VPC gateway endpoint for S3 and an interface VPC endpoint for Secrets Manager; keep instances in private subnets and configure security group rules attached to the endpoints to allow inbound traffic only from the application subnets.
Why this is correct
Gateway endpoints provide private routing to S3, and interface endpoints provide private access to Secrets Manager without internet traversal. Security group controls on interface endpoints restrict traffic to only the application subnets, meeting segmentation and cost constraints.
- ✗
Use public subnets with instances that have no security group rules; rely on AWS services to reject unauthorized traffic.
Why it's wrong here
Public subnets plus missing security controls violates baseline security. Relying on AWS service rejection does not provide explicit network segmentation or deterministic access control.
When this WOULD be correct
If the question required a simple, low-security setup for a non-production environment where instances need unrestricted outbound internet access and cost is the only concern, public subnets with no security groups might be acceptable.
- ✗
Create an S3 bucket policy that allows requests from the application instances’ private IP addresses and enable public access to Secrets Manager via the default service endpoint.
Why it's wrong here
Bucket policy cannot safely replace network-level private connectivity. Secrets Manager still requires private endpoint configuration or NAT/IGW routing for private subnets; public access contradicts requirements.
When this WOULD be correct
This option would be correct in a scenario where the application instances have public IPs and the requirement is to restrict access to S3 and Secrets Manager based on source IP addresses, while allowing internet access for other purposes. For example, a company using public subnets with security groups that restrict inbound traffic and needing to allow access to S3 and Secrets Manager from specific private IPs via bucket policies and resource-based policies.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.
✓Add a VPC gateway endpoint for S3 and an interface VPC endpoint for Secrets Manager; keep instances in private subnets and configure security group rules attached to the endpoints to allow inbound traffic only from the application subnets.Correct answer▾
Why this is correct
Gateway endpoints provide private routing to S3, and interface endpoints provide private access to Secrets Manager without internet traversal. Security group controls on interface endpoints restrict traffic to only the application subnets, meeting segmentation and cost constraints.
✗Place instances in private subnets but use NAT gateways so traffic to S3 and Secrets Manager goes through the internet; restrict security groups to instance-to-instance only.Wrong answer — click to see why▾
Why this is wrong here
NAT gateways route traffic through the public internet, violating the requirement to avoid public internet and incurring additional cost, which the question explicitly wants to avoid.
★ When this WOULD be the correct answer
If the question required internet access for other purposes (e.g., software updates) and cost was not a constraint, using NAT gateways in private subnets would be appropriate for outbound traffic to AWS services.
Why candidates choose this
Candidates may default to using NAT gateways for private subnet outbound traffic without considering VPC endpoints, or overlook the cost and internet routing constraints.
✗Use public subnets with instances that have no security group rules; rely on AWS services to reject unauthorized traffic.Wrong answer — click to see why▾
Why this is wrong here
Using public subnets without security groups exposes instances to inbound internet traffic, violating the requirement to avoid public internet and the security rule that only required VPC traffic should be allowed to reach AWS services.
★ When this WOULD be the correct answer
If the question required a simple, low-security setup for a non-production environment where instances need unrestricted outbound internet access and cost is the only concern, public subnets with no security groups might be acceptable.
Why candidates choose this
Candidates may think public subnets are simpler and cheaper, and mistakenly believe that AWS services inherently reject unauthorized traffic, ignoring the need for security groups and the requirement to avoid public internet.
✗Create an S3 bucket policy that allows requests from the application instances’ private IP addresses and enable public access to Secrets Manager via the default service endpoint.Wrong answer — click to see why▾
Why this is wrong here
Option D is wrong because enabling public access to Secrets Manager via the default service endpoint would expose the service to the internet, violating the requirement to avoid routing through the public internet and the security requirement to allow only required VPC traffic.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the application instances have public IPs and the requirement is to restrict access to S3 and Secrets Manager based on source IP addresses, while allowing internet access for other purposes. For example, a company using public subnets with security groups that restrict inbound traffic and needing to allow access to S3 and Secrets Manager from specific private IPs via bucket policies and resource-based policies.
Why candidates choose this
Candidates may think that using S3 bucket policies with IP restrictions and enabling public access to Secrets Manager is a simple way to allow access without additional VPC endpoints, overlooking the security and routing requirements that mandate private connectivity.
Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAA-C03
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company runs an application in private subnets (no inbound internet). The application must access Amazon S3 and AWS Secrets Manager endpoints without routing through the public internet and without exposing the instances to NAT gateways due to cost. Security requirements also state that only the required VPC traffic should be allowed to reach AWS services. Which architecture best satisfies these requirements?
medium- A.Place instances in private subnets but use NAT gateways so traffic to S3 and Secrets Manager goes through the internet; restrict security groups to instance-to-instance only.
- ✓ B.Add a VPC gateway endpoint for S3 and an interface VPC endpoint for Secrets Manager; keep instances in private subnets and configure security group rules attached to the endpoints to allow inbound traffic only from the application subnets.
- C.Use public subnets with instances that have no security group rules; rely on AWS services to reject unauthorized traffic.
- D.Create an S3 bucket policy that allows requests from the application instances’ private IP addresses and enable public access to Secrets Manager via the default service endpoint.
Why B: It uses a VPC gateway endpoint for Amazon S3 and an interface VPC endpoint for AWS Secrets Manager, both of which allow private subnet instances to access these services without traversing the public internet or requiring a NAT gateway. The security group rules attached to the interface endpoint restrict inbound traffic to only the application subnets, satisfying the security requirement of allowing only required VPC traffic. This architecture meets all constraints: no public internet, no NAT gateway cost, and least-privilege access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.