Cost-Effective S3 Access from VPC-Enabled Lambda

DEA-C01 By islever Editorial Last updated

Automate data processing by using AWS services.

Short answer

B Create a VPC gateway endpoint for Amazon S3 to route traffic privately without incurring endpoint fees.

Question

A company uses an AWS Lambda function to transfer files from a legacy SFTP environment to Amazon S3 buckets. The Lambda function is VPC enabled to ensure that all communications between the Lambda function and other AVS services that are in the same VPC environment will occur over a secure network. The Lambda function is able to connect to the SFTP environment successfully. However, when the Lambda function attempts to upload files to the S3 buckets, the Lambda function returns timeout errors. A data engineer must resolve the timeout issues in a secure way. Which solution will meet these requirements in the MOST cost-effective way?
  1. Create a NAT gateway in the public subnet of the VPC. Route network traffic to the NAT gateway.
  2. Create a VPC gateway endpoint for Amazon S3. Route network traffic to the VPC gateway endpoint. Correct Answer
  3. Create a VPC interface endpoint for Amazon S3. Route network traffic to the VPC interface endpoint.
  4. Use a VPC internet gateway to connect to the internet. Route network traffic to the VPC internet gateway.

Key Takeaways

The question tests knowledge of VPC endpoints for S3, specifically highlighting the common trap of choosing an Interface Endpoint or NAT Gateway when a free Gateway Endpoint is available for S3 access.

This question addresses resolving connectivity timeouts for a VPC-enabled AWS Lambda function accessing Amazon S3. It establishes that a VPC Gateway Endpoint is the correct solution due to its cost-effectiveness and lack of public IP requirement compared to other network configurations.

Common mistake: Many candidates select Option C (Interface Endpoint) because it provides private connectivity, but they overlook the significant hourly and data processing costs associated with Interface Endpoints compared to the free Gateway Endpoints.

Expert Analysis

Why the Answer Is Correct

Option B is the correct answer because a VPC Gateway Endpoint for Amazon S3 allows traffic to remain within the AWS network without traversing the internet. Crucially, Gateway Endpoints are free to use; you only pay for the underlying resources like EC2 instances or S3 storage, not for the endpoint itself. This makes it the most cost-effective way to resolve the timeout issue while maintaining security.

Why the Other Options Are Wrong

Option A (NAT Gateway) and Option D (Internet Gateway) involve routing traffic through the public internet, which incurs data transfer costs and potentially exposes the architecture to more risk than necessary. Option C (Interface Endpoint) uses PrivateLink, which charges an hourly fee plus per-gigabyte data processing fees, making it significantly more expensive than a Gateway Endpoint for simple S3 access.

Community Comment Notes

Community consensus strongly supports Option B, with users noting that Interface Endpoints, while viable, are more complex and expensive. As one commenter noted, "VPC interface endpoints charge per hour and per gigabyte of data transferred," highlighting the cost differential that drives the 'most cost-effective' requirement.

Exam Strategy

When asked for the 'most cost-effective' solution for S3 access from within a VPC, always consider the VPC Gateway Endpoint first as it is free. Only choose Interface Endpoints if you need to access services not supported by Gateway Endpoints or require specific PrivateLink features.

Frequently Asked Questions

Why is a VPC Gateway Endpoint preferred over an Interface Endpoint for S3?

Gateway Endpoints are free to create and manage, whereas Interface Endpoints incur hourly charges and per-GB data processing fees.

Does a VPC Gateway Endpoint support all AWS services?

No, Gateway Endpoints are currently only available for Amazon S3 and DynamoDB. Other services require Interface Endpoints.

More DEA-C01 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. ArunRav 👍 6 Answered B
    Option B - VPC Gateway Endpoint for Amazon S3
  2. phkhadse 👍 5
    Option B - VPC Gateway Endpoint for Amazon S3 While interface endpoints is a viable solution, it can be more complex and expensive compared to a gateway endpoint. VPC interface endpoints charge per hour and per gigabyte of data transferred.
  3. Ashishk1 👍 1 Answered C
    The solution that will meet the requirements of resolving the timeout issues when uploading files from the Lambda function to Amazon S3 buckets in a secure and cost-effective way is C. Create a VPC interface endpoint for Amazon S3. Route network traffic to the VPC interface endpoint .

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Amazon Redshift Compound Sort Key Query Optimization

S-grade

Secure Redshift Spectrum Access with VPC Endpoints

S-grade

Athena Federated Query for Multi-Source Iceberg Pipelines

S-grade

Reclaiming Storage in Amazon Redshift Materialized Views

S-grade

Practice All DEA-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DEA-C01 Practice Test →

← Back to DEA-C01 Study Guide