Question
An application runs on an Amazon EC2 instance in a VPC. The application processes logs that are stored in an Amazon S3 bucket. The EC2 instance needs to access the S3 bucket without connectivity to the internet.
Which solution will provide private network connectivity to Amazon S3?
- A. Create a gateway VPC endpoint to the S3 bucket. Correct
- B. Stream the logs to Amazon CloudWatch Logs. Export the logs to the S3 bucket.
- C. Create an instance profile on Amazon EC2 to allow S3 access.
- D. Create an Amazon API Gateway API with a private link to access the S3 endpoint.
Explanation
A gateway VPC endpoint for Amazon S3 adds a route to the VPC route tables so that traffic from the EC2 instance to S3 stays on the AWS network, with no internet gateway or NAT device needed, and at no extra charge. CloudWatch Logs export (B) does not give the instance private connectivity, an instance profile (C) grants permissions but not a network path, and API Gateway (D) is not a way to reach S3 privately from a VPC.
