A company runs EC2 instances in private subnets and needs to access Amazon S3 objects without using a NAT gateway. They want the traffic to stay within AWS private networking as much as possible (no internet egress). Which VPC endpoint type should they create for Amazon S3?

Create an Interface VPC endpoint for S3 and point the instances to it

Interface VPC endpoints (powered by AWS PrivateLink) use elastic network interfaces (ENIs) in your subnets and are supported for many services, but Amazon S3 is a special case. For S3, the supported private connectivity model is a Gateway VPC endpoint that integrates with route tables, not an interface endpoint.

Create a NAT gateway and allow outbound HTTPS to S3

A NAT gateway provides outbound internet connectivity. Even if the destination is S3 over HTTPS, traffic still traverses the NAT gateway and leaves the VPC via the internet path, which violates the requirement to avoid NAT/internet egress.

Create a VPC endpoint service and manually register S3 as a provider endpoint

VPC Endpoint Services are for exposing your own services privately (or consuming privately exposed endpoint services). S3 is not registered as a provider endpoint service by customers. The correct AWS-managed approach for S3 is a Gateway VPC endpoint.

What does this SAA-C03 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Create a Gateway VPC endpoint for S3 and update the route tables to use it — To access S3 from EC2 instances in private subnets without using a NAT gateway, create a Gateway VPC endpoint for the S3 service and associate it with the relevant private subnet route tables. The endpoint updates routing so that traffic destined for S3 prefix lists is sent through the AWS private networking path (via the VPC endpoint) instead of being forwarded through a NAT gateway to the internet. S3 does not use the interface-endpoint (ENI/PrivateLink) model; it uses a Gateway VPC endpoint that integrates with VPC route tables. A NAT gateway would still introduce internet egress, contradicting the requirement. Custom VPC endpoint services are not used to “register” S3 for private access; S3 private access is provided through the AWS-managed endpoint type.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.