Using Interface VPC Endpoint for Secrets Manager in Private Subnets
A web application runs in private subnets with no NAT gateway. It needs to retrieve credentials from AWS Secrets Manager at runtime. After a recent network hardening change, the application logs timeout errors when calling Secrets Manager.
Which change will most directly enable private connectivity to Secrets Manager while keeping the subnets NAT-free?
Quick Answer
The answer is to create an interface VPC endpoint (AWS PrivateLink) for Secrets Manager and update the security group rules to allow HTTPS from the application subnets. This is correct because an interface VPC endpoint uses Elastic Network Interfaces (ENIs) within your VPC to provide private connectivity to Secrets Manager without needing a NAT gateway, internet gateway, or any public IP, directly resolving the timeout errors caused by the network hardening change that removed public internet access. On the SAA-C03 exam, this scenario tests your understanding of how to enable Secrets Manager private connectivity without NAT, often appearing as a trap where candidates mistakenly add a NAT gateway or a VPC gateway endpoint—remember that Secrets Manager only supports interface endpoints, not gateway endpoints. A simple memory tip: "Secrets need an interface, not a gateway."
⚠ Common exam trap
The trap here is that candidates might think a NAT gateway or internet gateway is required for any AWS service access, overlooking that AWS PrivateLink interface endpoints can provide private, direct connectivity to services like Secrets Manager without any public internet exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an interface VPC endpoint (AWS PrivateLink) for the Secrets Manager service and update the security group rules to allow HTTPS from the application subnets.
An interface VPC endpoint (AWS PrivateLink) for Secrets Manager creates a private, direct connection to the service within the VPC, using Elastic Network Interfaces (ENIs) in the subnets. This allows the application to reach Secrets Manager over HTTPS without traversing the internet, a NAT gateway, or an internet gateway, directly resolving the timeout errors caused by the network hardening change that removed public internet access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an interface VPC endpoint (AWS PrivateLink) for the Secrets Manager service and update the security group rules to allow HTTPS from the application subnets.
Why this is correct
An interface VPC endpoint provides private, route-table-scoped connectivity to Secrets Manager without internet access or NAT. Security group rules on the endpoint enforce which subnets/instances can reach it.
- ✗
Add a public DNS entry in the instance /etc/hosts pointing Secrets Manager to the instance’s private IP so requests do not leave the VPC.
Why it's wrong here
Secrets Manager is not reachable by mapping it to arbitrary private IPs; you need an AWS-managed private endpoint or NAT/internet for real service routing.
When this WOULD be correct
If the question described a scenario where the application needs to resolve a custom domain name to a private IP within the VPC (e.g., for a database or internal service) and the VPC already has a private network path (like a VPN or Direct Connect) to that IP, then adding a hosts entry would be a quick fix to avoid DNS resolution issues.
- ✗
Attach an internet gateway to the private route table so that Secrets Manager traffic can reach public endpoints without NAT.
Why it's wrong here
An internet gateway on a private route table effectively makes the subnet internet-reachable, violating the stated NAT-free and tightened network requirement.
When this WOULD be correct
In a scenario where a public subnet's route table needs to allow direct outbound internet access for instances with public IPs, attaching an internet gateway to that route table is correct. For example, a web server in a public subnet that must reach public endpoints without NAT.
- ✗
Enable S3 VPC endpoint and store the secrets in an S3 bucket instead of Secrets Manager, then retrieve them using S3 gateway endpoints.
Why it's wrong here
This changes the service and does not solve the Secrets Manager connectivity failure. It also weakens secret lifecycle controls provided by Secrets Manager.
When this WOULD be correct
In a scenario where an application needs to retrieve configuration data or secrets stored in S3, and the subnets have no NAT gateway, an S3 VPC endpoint (gateway endpoint) would provide private connectivity to S3 without requiring a NAT or internet gateway.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create an interface VPC endpoint (AWS PrivateLink) for the Secrets Manager service and update the security group rules to allow HTTPS from the application subnets.Correct answer▾
Why this is correct
An interface VPC endpoint provides private, route-table-scoped connectivity to Secrets Manager without internet access or NAT. Security group rules on the endpoint enforce which subnets/instances can reach it.
✗Add a public DNS entry in the instance /etc/hosts pointing Secrets Manager to the instance’s private IP so requests do not leave the VPC.Wrong answer — click to see why▾
Why this is wrong here
Modifying /etc/hosts on an instance does not create a private network path; traffic still routes through the internet unless a private connection exists. Without a NAT gateway or VPC endpoint, the instance cannot reach the public Secrets Manager endpoint, so the change does not resolve the timeout.
★ When this WOULD be the correct answer
If the question described a scenario where the application needs to resolve a custom domain name to a private IP within the VPC (e.g., for a database or internal service) and the VPC already has a private network path (like a VPN or Direct Connect) to that IP, then adding a hosts entry would be a quick fix to avoid DNS resolution issues.
Why candidates choose this
Candidates may think that overriding DNS resolution with a private IP keeps traffic within the VPC, but they overlook that the underlying network path still requires a route to the destination, which is missing without a VPC endpoint or NAT.
✗Attach an internet gateway to the private route table so that Secrets Manager traffic can reach public endpoints without NAT.Wrong answer — click to see why▾
Why this is wrong here
Attaching an internet gateway to a private route table would expose the private subnets to the internet, violating the requirement to keep subnets NAT-free and private, and it does not provide private connectivity to Secrets Manager.
★ When this WOULD be the correct answer
In a scenario where a public subnet's route table needs to allow direct outbound internet access for instances with public IPs, attaching an internet gateway to that route table is correct. For example, a web server in a public subnet that must reach public endpoints without NAT.
Why candidates choose this
Candidates may think that an internet gateway provides direct internet access without NAT, but they overlook that it must be attached to public subnets, not private ones, and that it does not create a private connection to AWS services.
✗Enable S3 VPC endpoint and store the secrets in an S3 bucket instead of Secrets Manager, then retrieve them using S3 gateway endpoints.Wrong answer — click to see why▾
Why this is wrong here
This option suggests using S3 instead of Secrets Manager, but the question explicitly requires retrieving credentials from AWS Secrets Manager. Changing the service is not a direct solution to enable private connectivity to Secrets Manager.
★ When this WOULD be the correct answer
In a scenario where an application needs to retrieve configuration data or secrets stored in S3, and the subnets have no NAT gateway, an S3 VPC endpoint (gateway endpoint) would provide private connectivity to S3 without requiring a NAT or internet gateway.
Why candidates choose this
Candidates may think that using S3 with a VPC endpoint is a valid workaround to avoid NAT, but they overlook the requirement to use Secrets Manager specifically, not S3.
Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
About these practice questions
One of 302 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAA-C03
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your application runs in private subnets with no NAT gateway. It needs to call AWS Secrets Manager to retrieve secrets. For private connectivity without internet egress, which VPC endpoint type should you create for AWS Secrets Manager?
easy- ✓ A.An Interface VPC endpoint (AWS PrivateLink) for secretsmanager in your Region
- B.A Gateway VPC endpoint for secretsmanager
- C.A NAT gateway in the private subnet route table
- D.A VPC peering connection to the AWS public network hosting Secrets Manager
Why A: An Interface VPC endpoint (AWS PrivateLink) creates an elastic network interface in your subnet with a private IP address, allowing your instances to communicate with AWS Secrets Manager over the AWS network without traversing the internet. Since your application runs in private subnets with no NAT gateway, this is the only supported endpoint type for Secrets Manager, as Gateway endpoints are only available for S3 and DynamoDB.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.