VPC Gateway Endpoint for S3: Private Access to S3 from Private Subnets
A company has a VPC with multiple subnets. The SysOps administrator wants to ensure that EC2 instances in a private subnet can access Amazon S3 without going through a NAT Gateway or internet gateway. Which solution meets this requirement?
Quick Answer
The answer is to create a VPC Gateway Endpoint for S3. This is correct because a Gateway Endpoint uses Amazon’s private network to route traffic from your private subnets directly to S3, bypassing the need for a NAT Gateway or internet gateway entirely. It works by adding a prefix list to the route table of your private subnets, directing S3-bound traffic through the endpoint rather than over the public internet. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this question tests your understanding of cost-effective, private connectivity options—a common trap is confusing Gateway Endpoints with Interface Endpoints, but remember that S3 and DynamoDB are the only services that support Gateway Endpoints, which are free and do not require additional IP addresses. A useful memory tip: Gateway Endpoints are like a private tunnel for S3, while Interface Endpoints are for everything else.
⚠ Common exam trap
SOA-C02 often tests the distinction between Gateway Endpoints (S3/DynamoDB, free, route-table based) and Interface Endpoints (PrivateLink, ENI-based, hourly cost) — candidates frequently pick Interface Endpoint for S3 because it sounds more 'private'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a VPC Gateway Endpoint for S3.
A VPC Gateway Endpoint for S3 provides private connectivity from a VPC to Amazon S3 without requiring a NAT Gateway, internet gateway, or VPN. Traffic to S3 stays entirely within the AWS network, and the endpoint is added as a target in the route table for the private subnet. This is the only option that satisfies the 'no NAT/IGW' constraint for S3 specifically.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set up a NAT Gateway in a public subnet and route traffic through it.
Why it's wrong here
A NAT Gateway still routes S3 traffic through a public subnet and internet gateway, directly violating the requirement to avoid both. It is the right design when private instances need general outbound internet access to arbitrary endpoints, not for private S3-only connectivity.
- ✓
Create a VPC Gateway Endpoint for S3.
Why this is correct
A VPC Gateway Endpoint attaches to route tables and provides private connectivity to S3 using prefix lists, so traffic never traverses a NAT gateway or internet gateway. This satisfies the requirement that private-subnet instances reach S3 without either egress device.
- ✗
Use S3 Transfer Acceleration.
Why it's wrong here
Transfer Acceleration speeds uploads and downloads over AWS edge locations but still traverses the public internet via S3's public endpoints, so it cannot bypass NAT or an internet gateway. It is chosen when globally distributed clients need faster public S3 transfers.
- ✗
Create a VPC Interface Endpoint for S3.
Why it's wrong here
Interface Endpoint is possible but more expensive; Gateway Endpoint is better for S3.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 1,169-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SysOps Administrator is configuring a VPC with a public subnet and a private subnet. The public subnet has an Internet Gateway. An EC2 instance in the private subnet needs to access an S3 bucket. What is the MOST secure way to provide this access?
hard- A.Attach an Internet Gateway to the private subnet.
- ✓ B.Create a VPC Gateway Endpoint for S3 in the private subnet's route table.
- C.Use a VPC peering connection to an S3 bucket.
- D.Create a NAT Gateway in the public subnet and route traffic through it.
Why B: A VPC Gateway Endpoint for S3 allows instances in a private subnet to access S3 privately without traversing the internet, using AWS's internal network. This is the most secure method as it avoids exposing the private subnet to the public internet or requiring a NAT Gateway, and it leverages AWS PrivateLink for direct, low-latency connectivity.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.