Secure On-Premises to AWS Data Transfer without Internet

Why the Answer Is Correct

Option B is the correct answer because it directly addresses both critical constraints: the need for a secure, private connection and the secure management of credentials. AWS Direct Connect provides a dedicated, private network link between the on-premises data center and AWS, ensuring that data does not traverse the public internet. Storing service account credentials in AWS Secrets Manager ensures that sensitive authentication information is encrypted at rest, managed securely, and can be rotated easily, which is essential for automated pipelines.

Why the Other Options Are Wrong

Options A and C suggest using public subnets and security groups. Even if restricted by CIDR blocks, traffic routed through public subnets typically implies exposure to the public internet or reliance on NAT gateways/Internet Gateways, violating the "not use the public internet" requirement. Option D adds presigned URLs to S3 buckets; while presigned URLs are useful for temporary access, they do not address the core requirement of establishing a persistent, secure connection for migrating many data pipelines, and the option redundantly mixes networking concepts with object storage access controls unnecessarily compared to the direct simplicity of B. Furthermore, Option D's inclusion of presigned URLs doesn't inherently solve the "secure connection" aspect for pipeline orchestration as well as Direct Connect alone paired with secret management does.

Community Comment Notes

Community consensus strongly favors Option B. Users note that other options contain "partial nonsense" or fail to meet the strict non-internet constraint. As one user noted, "For secure connections without cost constraints, always think Direct Connect," highlighting the priority of the network architecture in this scenario.