How to Connect On-Premises and EC2 to S3 Privately and Cost-Effectively?
A company hosts application servers on premises and on Amazon EC2 instances in a VPC. The application servers access data that is hosted in an Amazon S3 bucket through the public internet. The EC2 instances in the VPC use an AWS Site-to-Site VPN for connectivity with the on-premises application servers. New company regulations state that all traffic between the application servers and the S3 bucket must remain private and must not use public IP addresses. Which solution will meet these requirements MOST cost-effectively?
Community Votes
64% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests understanding that S3 gateway endpoints are VPC-local and unreachable from on-premises, so an interface endpoint is required for on-premises access, while EC2 should use the free gateway endpoint for cost-effectiveness.
This question tests the optimal combination of S3 gateway and interface endpoints to keep traffic between on-premises servers, EC2 instances, and an S3 bucket entirely private while minimizing cost. Community consensus favors Option C because gateway endpoints (free) serve EC2 traffic and a single interface endpoint (paid) serves on-premises traffic via the Site-to-Site VPN.
Many candidates choose Option B, assuming a single interface endpoint covers both EC2 and on-premises. They overlook that gateway endpoints are free and preferred for in-VPC traffic, making Option C more cost-effective.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Understanding the Requirements
The scenario involves two traffic sources — on-premises application servers and EC2 instances in a VPC — both needing private access to an Amazon S3 bucket without using public IP addresses. The key constraints are privacy (no internet traversal) and cost-effectiveness.
Why Option C is Correct
Option C combines the strengths of both endpoint types:
- S3 Gateway Endpoint (free): Configured in the VPC route table, it allows EC2 instances to reach S3 over the AWS backbone without NAT or internet egress. It costs nothing.
- S3 Interface Endpoint (paid, per AZ-hour + data processing): Required because gateway endpoints are not reachable from outside the VPC, including from on-premises networks connected via Site-to-Site VPN. On-premises servers resolve the interface endpoint's private DNS name and route traffic through the VPN into the VPC, then to S3 privately.
Why Other Options Fail
- Option A: A gateway endpoint alone cannot serve on-premises servers because it is only routable from within the VPC.
- Option B: Using only an interface endpoint for both sources works functionally but is not the MOST cost-effective, since EC2 traffic would incur interface endpoint data processing charges instead of using the free gateway endpoint.
- Option D: Adds an unnecessary proxy fleet and Network Load Balancer, dramatically increasing cost and complexity without solving the core requirement more effectively.
Community Insight
As user woorkim noted, Option C uses each endpoint type where it is most appropriate and avoids unnecessary components. User nico73 correctly pointed out that gateway endpoints are not accessible from sources outside the VPC, which is the crux of why an interface endpoint is mandatory for on-premises traffic.
Official Reference
Exam Strategy
When an AWS question mentions 'MOST cost-effectively,' always compare the pricing models of the options (e.g., free gateway vs. paid interface endpoints). Eliminate choices that add unnecessary managed services like proxies or NLBs unless the architecture explicitly requires them.
Related Analysis
Practice All ANS-C01 Questions
Access 137 questions with complete answers and detailed explanations.
View Full ANS-C01 Practice Test →