How to Connect On-Premises and EC2 to S3 Privately and Cost-Effectively?

ANS-C01 By islever Editorial Last updated

Short answer

C Configure an S3 interface endpoint. Update the on-premises servers to use the interface endpoint DNS name to access the S3 bucket. Configure an S3 gateway endpoint. Modify the route table so that the EC2 instances use the gateway endpoint.

Question

A company hosts application servers on premises and on Amazon EC2 instances in a VPC. The application servers access data that is hosted in an Amazon S3 bucket through the public internet. The EC2 instances in the VPC use an AWS Site-to-Site VPN for connectivity with the on-premises application servers. New company regulations state that all traffic between the application servers and the S3 bucket must remain private and must not use public IP addresses. Which solution will meet these requirements MOST cost-effectively?
  1. Configure an S3 gateway endpoint Modify the route table with the appropriate route for the endpoint. Access the S3 bucket through the gateway endpoint from the EC2 instances.
  2. Configure an S3 interface endpoint. Update the on-premises servers and EC2 instances to use the interface endpoint DNS name to access the S3 bucket.
  3. Configure an S3 interface endpoint. Update the on-premises servers to use the interface endpoint DNS name to access the S3 bucket. Configure an S3 gateway endpoint. Modify the route table so that the EC2 instances use the gateway endpoint. Correct Answer
  4. Configure an S3 gateway endpoint. Modify the route table with the appropriate route for the endpoint. Use an S3 bucket policy to restrict access to the gateway endpoint. Configure a proxy server fleet behind a Network Load Balancer in the VPC so that the on-premises servers can access the S3 bucket.

Key Takeaways

The question tests understanding that S3 gateway endpoints are VPC-local and unreachable from on-premises, so an interface endpoint is required for on-premises access, while EC2 should use the free gateway endpoint for cost-effectiveness.

This question tests the optimal combination of S3 gateway and interface endpoints to keep traffic between on-premises servers, EC2 instances, and an S3 bucket entirely private while minimizing cost. Community consensus favors Option C because gateway endpoints (free) serve EC2 traffic and a single interface endpoint (paid) serves on-premises traffic via the Site-to-Site VPN.

Common mistake: Many candidates choose Option B, assuming a single interface endpoint covers both EC2 and on-premises. They overlook that gateway endpoints are free and preferred for in-VPC traffic, making Option C more cost-effective.

Expert Analysis

Understanding the Requirements

The scenario involves two traffic sources — on-premises application servers and EC2 instances in a VPC — both needing private access to an Amazon S3 bucket without using public IP addresses. The key constraints are privacy (no internet traversal) and cost-effectiveness.

Why Option C is Correct

Option C combines the strengths of both endpoint types:

  • S3 Gateway Endpoint (free): Configured in the VPC route table, it allows EC2 instances to reach S3 over the AWS backbone without NAT or internet egress. It costs nothing.
  • S3 Interface Endpoint (paid, per AZ-hour + data processing): Required because gateway endpoints are not reachable from outside the VPC, including from on-premises networks connected via Site-to-Site VPN. On-premises servers resolve the interface endpoint's private DNS name and route traffic through the VPN into the VPC, then to S3 privately.
This hybrid approach is explicitly recommended in the [AWS Architecture Blog on VPC endpoint strategy for S3](https://aws.amazon.com/blogs/architecture/choosing-your-vpc-endpoint-strategy-for-amazon-s3/).

Why Other Options Fail

  • Option A: A gateway endpoint alone cannot serve on-premises servers because it is only routable from within the VPC.
  • Option B: Using only an interface endpoint for both sources works functionally but is not the MOST cost-effective, since EC2 traffic would incur interface endpoint data processing charges instead of using the free gateway endpoint.
  • Option D: Adds an unnecessary proxy fleet and Network Load Balancer, dramatically increasing cost and complexity without solving the core requirement more effectively.

Community Insight

As user woorkim noted, Option C uses each endpoint type where it is most appropriate and avoids unnecessary components. User nico73 correctly pointed out that gateway endpoints are not accessible from sources outside the VPC, which is the crux of why an interface endpoint is mandatory for on-premises traffic.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When an AWS question mentions 'MOST cost-effectively,' always compare the pricing models of the options (e.g., free gateway vs. paid interface endpoints). Eliminate choices that add unnecessary managed services like proxies or NLBs unless the architecture explicitly requires them.

Community Votes

C
64%
B
36%

64% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. nico73 👍 3 Answered C
    because gateway endpoints are not accessible from sources outside the VPC
  2. woorkim 👍 2 Answered C
    most cost-effective solution because: Gateway endpoints are free and perfect for EC2 instances in the VPC Interface endpoints, while having a cost, are necessary for on-premises servers Each type of server uses the most appropriate endpoint type No unnecessary components like proxy fleets or load balancers
  3. meseerie 👍 2 Answered B
    B. traffic is sourced from On-Prem to S3 in private. So Interface endpoint is needed.
  4. TechAwesome 👍 1 Answered B
    Both B and C make sense. Depends how do you understand "must not use public IP addresses". Even with Gateway endpoint, you are still accessing S3's public IP address..The question is not clear.
  5. jfedotov 👍 1 Answered B
    B is correct "A company hosts application servers on-premises and on Amazon EC2 instances" Both onprem and ec2 send traffic to S3, so it should be S3 Interface.
Show 2 more comments
  1. c1193d4 👍 1 Answered C
    C: see this architecture in https://aws.amazon.com/blogs/architecture/choosing-your-vpc-endpoint-strategy-for-amazon-s3/
  2. jfedotov 👍 1 Answered C
    C is correct S3 Interface Endpoint with the option "Enable private DNS only for inbound endpoint" S3 Gateway for EC2

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide