Cost-Effective S3 Access from VPC-Enabled Lambda
A company uses an AWS Lambda function to transfer files from a legacy SFTP environment to Amazon S3 buckets. The Lambda function is VPC enabled to ensure that all communications between the Lambda function and other AVS services that are in the same VPC environment will occur over a secure network. The Lambda function is able to connect to the SFTP environment successfully. However, when the Lambda function attempts to upload files to the S3 buckets, the Lambda function returns timeout errors. A data engineer must resolve the timeout issues in a secure way. Which solution will meet these requirements in the MOST cost-effective way?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of VPC endpoints for S3, specifically highlighting the common trap of choosing an Interface Endpoint or NAT Gateway when a free Gateway Endpoint is available for S3 access.
This question addresses resolving connectivity timeouts for a VPC-enabled AWS Lambda function accessing Amazon S3. It establishes that a VPC Gateway Endpoint is the correct solution due to its cost-effectiveness and lack of public IP requirement compared to other network configurations.
Many candidates select Option C (Interface Endpoint) because it provides private connectivity, but they overlook the significant hourly and data processing costs associated with Interface Endpoints compared to the free Gateway Endpoints.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is the correct answer because a VPC Gateway Endpoint for Amazon S3 allows traffic to remain within the AWS network without traversing the internet. Crucially, Gateway Endpoints are free to use; you only pay for the underlying resources like EC2 instances or S3 storage, not for the endpoint itself. This makes it the most cost-effective way to resolve the timeout issue while maintaining security.Why the Other Options Are Wrong
Option A (NAT Gateway) and Option D (Internet Gateway) involve routing traffic through the public internet, which incurs data transfer costs and potentially exposes the architecture to more risk than necessary. Option C (Interface Endpoint) uses PrivateLink, which charges an hourly fee plus per-gigabyte data processing fees, making it significantly more expensive than a Gateway Endpoint for simple S3 access.Community Comment Notes
Community consensus strongly supports Option B, with users noting that Interface Endpoints, while viable, are more complex and expensive. As one commenter noted, "VPC interface endpoints charge per hour and per gigabyte of data transferred," highlighting the cost differential that drives the 'most cost-effective' requirement.Exam Strategy
When asked for the 'most cost-effective' solution for S3 access from within a VPC, always consider the VPC Gateway Endpoint first as it is free. Only choose Interface Endpoints if you need to access services not supported by Gateway Endpoints or require specific PrivateLink features.
Frequently Asked Questions
Why is a VPC Gateway Endpoint preferred over an Interface Endpoint for S3?
Gateway Endpoints are free to create and manage, whereas Interface Endpoints incur hourly charges and per-GB data processing fees.
Does a VPC Gateway Endpoint support all AWS services?
No, Gateway Endpoints are currently only available for Amazon S3 and DynamoDB. Other services require Interface Endpoints.
Related Analysis
Practice All DEA-C01 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DEA-C01 Practice Test →