S3 VPC Gateway Endpoint for Private Subnet Access
A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which configuration provides the most secure and efficient access?
Quick Answer
The correct answer is to create a Gateway VPC Endpoint for S3 and update the route table. This configuration allows an EC2 instance in a private subnet to access S3 without internet access, using AWS’s internal network instead of traversing a NAT Gateway, Internet Gateway, or public internet. A Gateway Endpoint uses prefix lists in the route table to direct S3 traffic privately, making it both more secure and more cost-effective than an Interface Endpoint, which incurs hourly charges and requires additional DNS resolution. On the AWS Certified Security Specialty SCS-C02 exam, this question tests your understanding of VPC networking security and the principle of least privilege—specifically, how to keep traffic within the AWS backbone. A common trap is choosing an Interface Endpoint for S3, but remember: S3 and DynamoDB are the only services that support Gateway Endpoints, which are free and simpler. Memory tip: “Gateway for S3—no gateway to the internet needed.”
⚠ Common exam trap
A common mix-up: candidates confuse Interface VPC Endpoints (which are required for most AWS services) with Gateway VPC Endpoints (which are only for S3 and DynamoDB), leading them to choose the more expensive and complex Interface Endpoint for S3.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Gateway VPC Endpoint for S3 and update the route table.
A Gateway VPC Endpoint for S3 provides private, secure access to S3 without traversing the internet, using AWS's internal network. It is more efficient than an Interface Endpoint for S3 because it does not incur hourly charges or require additional route table entries for each subnet, and it leverages prefix lists to route traffic directly to S3 via the route table. This configuration ensures the EC2 instance in the private subnet can access S3 without a NAT Gateway or public IP, maintaining security and minimizing data transfer costs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an Interface VPC Endpoint for S3.
Why it's wrong here
Interface Endpoints are for services that use PrivateLink; S3 typically uses Gateway Endpoints.
- ✓
Create a Gateway VPC Endpoint for S3 and update the route table.
Why this is correct
Private and secure access to S3.
- ✗
Route the traffic through a NAT Gateway to the internet.
Why it's wrong here
Uses internet, less secure.
- ✗
Assign a public IP address to the EC2 instance and allow it to access S3 via internet.
Why it's wrong here
Insecure and exposes instance.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket to store logs. The security team wants to ensure that traffic does not traverse the internet. Which solution should be used? (Choose two.)
hard- ✓ A.Create an S3 Gateway Endpoint in the VPC
- ✓ B.Attach a VPC Endpoint Policy to the Gateway Endpoint to restrict access to the specific bucket
- C.Attach an Internet Gateway to the VPC
- D.Create an S3 Interface Endpoint in the VPC
- E.Use a NAT Gateway to route the traffic to the internet
Why A: A VPC Gateway Endpoint (option A) allows instances in a private subnet to access S3 without traversing the internet by routing traffic through AWS's internal network. This is the correct foundational component because it uses prefix lists in the route table to direct S3 traffic to the endpoint, bypassing the need for an Internet Gateway or NAT Gateway.
Variation 2. A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet with a default security group that allows all outbound traffic. The instance needs to download files from an S3 bucket in the same region. Which configuration allows this without internet access?
hard- A.Set up an AWS Direct Connect connection to the S3 bucket.
- ✓ B.Create a VPC gateway endpoint for S3 and add a route to the private subnet's route table.
- C.Attach an internet gateway to the VPC and add a route to the private subnet.
- D.Create a NAT gateway in the public subnet and add a route to the private subnet's route table.
Why B: A VPC gateway endpoint for S3 allows instances in a private subnet to access S3 without traversing the internet. By adding a route to the private subnet's route table that points to the endpoint, traffic destined for S3 stays within the AWS network. The default security group's outbound rule permits all traffic, so no additional security group changes are needed.
Variation 3. A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to minimize costs and avoid NAT Gateway or NAT Instance charges. Which solution should be used?
hard- A.Deploy a proxy instance in a public subnet and configure the private instance to use the proxy.
- B.Use an egress-only internet gateway for the private subnet.
- C.Attach an internet gateway to the VPC and add a route to the private subnet route table pointing to the internet gateway.
- ✓ D.Create a VPC Gateway Endpoint for S3 and configure the instance to download patches from S3.
Why D: A VPC Gateway Endpoint for S3 allows private subnet resources to access S3 over the AWS network without traversing the internet, avoiding NAT Gateway or NAT Instance charges. The patches can be stored in an S3 bucket and downloaded by the EC2 instance using the endpoint, which uses AWS PrivateLink and does not require an internet gateway or public IP.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.