How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

ANS-C01 By islever Editorial Last updated

Short answer

C Create a private VIF on the Direct Connect connection. Create an Amazon S3 interface endpoint in the VPC.

Question

A company’s data center is connected to a single AWS Region by an AWS Direct Connect dedicated connection. The company has a single VPC in the Region. The company stores logs for all its applications locally in the data center. The company must keep all application logs for 7 years. The company decides to copy all application logs to an Amazon S3 bucket. Which solution will meet these requirements?
  1. Create a public VIF on the Direct Connect connection. Create an Amazon S3 gateway endpoint in the VPC.
  2. Create a private VIF on the Direct Connect connection. Create an Amazon S3 gateway endpoint in the VPC.
  3. Create a private VIF on the Direct Connect connection. Create an Amazon S3 interface endpoint in the VPC. Correct Answer
  4. Create a public VIF on the Direct Connect connection. Create an Amazon S3 interface endpoint in the VPC.

Key Takeaways

The question tests whether candidates know that S3 gateway endpoints are only reachable from within the VPC, so on-premises traffic over Direct Connect requires an S3 interface endpoint (PrivateLink) paired with a private VIF.

This question tests the correct combination of AWS Direct Connect Virtual Interface (VIF) type and Amazon S3 VPC endpoint to enable on-premises applications to upload logs to S3 privately. The correct solution uses a private VIF with an S3 interface endpoint (AWS PrivateLink) because gateway endpoints are not reachable from outside the VPC.

Common mistake: Many candidates choose option B (private VIF + S3 gateway endpoint) because gateway endpoints are free and typically the default for S3 access from within a VPC. They forget that gateway endpoints are not routable from on-premises networks over Direct Connect.

Expert Analysis

Understanding the Requirements

The scenario requires on-premises applications in the company's data center to copy application logs to an Amazon S3 bucket over an AWS Direct Connect connection. The traffic must remain private (no internet), and it must originate from outside the VPC (from the on-premises data center).

Why Option C Is Correct

To meet the requirements, two decisions must be made:

  1. Which type of Virtual Interface (VIF) on Direct Connect?
  • A private VIF connects the on-premises data center directly to a VPC using private IP addresses. This is the correct choice for private, secure connectivity to AWS resources inside a VPC.
  • - A public VIF is used to access AWS public services (such as S3, DynamoDB) directly via public AWS endpoints, not through a VPC.

2. Which type of VPC endpoint for Amazon S3?

  • An S3 gateway endpoint is free and works well for traffic originating inside the VPC. However, it is implemented via VPC route tables and is not reachable from outside the VPC, including from on-premises networks over Direct Connect or VPN.
  • - An S3 interface endpoint (powered by AWS PrivateLink) provisions ENIs inside the VPC and is reachable from both inside the VPC and from external sources such as an on-premises data center connected via Direct Connect. This makes it the correct choice when the source of the traffic is on-premises.

Therefore, Option C (private VIF + S3 interface endpoint) is the only combination that allows on-premises applications to reach S3 privately over Direct Connect.

Why the Other Options Are Wrong

  • Option A (public VIF + gateway endpoint): A public VIF is used to reach AWS public services directly, not through a VPC. Gateway endpoints also cannot be reached from on-premises.
  • Option B (private VIF + gateway endpoint): Although the private VIF is correct, the gateway endpoint is not accessible from on-premises because it relies on VPC route tables. This is the most common trap.
  • Option D (public VIF + interface endpoint): A public VIF does not route through a VPC, so an interface endpoint inside the VPC would not be used in this path.

Community Insight

As several candidates noted in the comments, the key distinction is that gateway endpoints are not accessible from sources outside the VPC (like Direct Connect). Interface endpoints using AWS PrivateLink are required when the traffic originates from on-premises. While interface endpoints do incur a cost, they are the only valid solution in this scenario.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When an AWS exam question involves traffic originating from on-premises over Direct Connect or VPN to reach an AWS service inside a VPC, always check whether the VPC endpoint is reachable from outside the VPC. Gateway endpoints are VPC-internal only; interface endpoints (PrivateLink) are required for external sources.

Community Votes

C
46%
B
38%
A
15%

46% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. woorkim 👍 3 Answered C
    https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html you allow in-VPC applications to continue accessing Amazon S3 through the gateway endpoint, which is not billed. Then, only your on-premises applications would use interface endpoints to access Amazon S3.
  2. zanhsieh 👍 3 Answered B
    I pick B. All options can access S3. GW endpoint is free but interface endpoint isn't. Security wise we will pick private VIF not public VIF, and pick GW endpoint not interface endpoint.
  3. secdaddy 👍 2 Answered A
    How about (A) that has an S3 gateway (preferred as free) endpoint providing S3 for inside the VPC and the public VIF providing S3 service for the DC across DX.
  4. c1193d4 👍 2 Answered C
    C: because gateway endpoints are not accessible from sources outside the VPC (like DX)
  5. ashk123456 👍 1 Answered B
    Private Virtual Interface (VIF): A private VIF is used to access AWS services like Amazon S3 through your VPC. It enables private connectivity between your on-premises data center and your VPC over Direct Connect. S3 Gateway Endpoint: This is the appropriate endpoint type for Amazon S3. Gateway endpoints are the recommended way to connect to S3 from a VPC as they use route tables to direct traffic over the AWS private network to S3 without traversing the internet.
Show 2 more comments
  1. kowal_001 👍 1 Answered C
    Interface Endpoint for Amazon S3: Unlike gateway endpoints, interface endpoints (using AWS PrivateLink) are accessible from both inside the VPC and from external sources such as an AWS Direct Connect connection or VPN. This makes the interface endpoint the right choice when the application logs stored locally in the data center need to be uploaded to S3 over the Direct Connect connection.
  2. siheom 👍 1 Answered B
    vote B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

How Should Network Engineers Increase Payload Size Through a Transit Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide