Private S3 Upload from EC2 Without Public Internet
Design secure access to AWS resources.
Determine high-performing and/or scalable network architectures.
Answer
Correct answer: A — Create an interface VPC endpoint for Amazon S3 in the EC2 instance's subnet and lock the bucket policy to that instance's IAM role.
A company needs to move data from an Amazon EC2 instance to an Amazon S3 bucket. The company must ensure that no API calls and no data are routed through public internet routes. Only the EC2 instance can have access to upload data to the S3 bucket. Which solution will meet these requirements?
Community Insight
The question tests which VPC endpoint type for S3 keeps API calls and data off the public internet while still supporting the required network-level controls — and the trap is picking the gateway endpoint option that misdescribes its placement and its security-group support.
This SAA-C03 scenario asks how an EC2 instance can reach an Amazon S3 bucket entirely over private AWS networking while restricting upload rights to that instance's IAM role. The correct design is an interface VPC endpoint for S3 in the instance's subnet combined with a bucket policy that allows only the EC2 instance's IAM role.
Option B is the most-chosen wrong answer because a gateway endpoint is the 'classic' free S3 path, but it is created at the VPC level (not 'in an Availability Zone') and gateway endpoints cannot have security groups attached — only route-table and endpoint policies apply.
Community Discussion (132 comments)
Sushmita42
👍 1
Selected: B
A gateway endpoint is the standard AWS solution for private access to Amazon S3 and DynamoDB from a VPC. One important correction to the wording of B: a gateway endpoint is associated with route tables, not an Availability Zone, and you don't attach security groups to a gateway endpoint. Those details are slightly inaccurate, but B is clearly the intended answer because it is the only option using the correct S3 gateway endpoint architecture. S3 → Gateway VPC Endpoint rather than an interface endpoint.
2422182
👍 1
Selected: A
Cannot be B: - Gateway VPCs cannot have security groups
111380c
👍 1
Selected: B
interface VPC endpoint 's used for SNS, SQS, KMS, Secrets Manager, but excepted S3
607d657
👍 1
Selected: B
B. Create a gateway VPC endpoint for Amazon S3
Clouddon
👍 1
Selected: B
B. Create a gateway VPC endpoint for Amazon S3 in the Availability Zone where the EC2 instance is located. Attach appropriate security groups to the endpoint. Attach a resource policy to the S3 bucket to only allow the EC2 instance’s IAM role for access. ✅ Why this is the correct solution: The requirements are: 🔒 No API calls or data should go through the public internet ✅ Only the EC2 instance should be able to upload to S3 🧠 Minimize public exposure and securely control access
Smith3136
👍 1
Selected: B
Only Gateway Endpoint can be attached to S3. Interface Endpoint is not an option with S3
TEC65
👍 1
Selected: B
Here's why this option is suitable: Gateway VPC Endpoint for Amazon S3: A gateway VPC endpoint allows you to privately connect your VPC to supported AWS services, such as Amazon S3, without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Traffic between your VPC and the service does not leave the Amazon network. Resource Policy: By attaching a resource policy to the S3 bucket that only allows access from the EC2 instance's IAM role, you ensure that only authorized instances can access the bucket. Here's why the other options are not as suitable: A. Create an interface VPC endpoint for Amazon S3: Amazon S3 uses gateway VPC endpoints, not interface VPC endpoints. Interface VPC endpoints are used for services that are not supported by gateway endpoints.
7dcef09
👍 1
Selected: B
Interface Endpoint = AWS PrivateLink Gateway Endpoint = Supports S3 and DynamoDB
nadeerm
👍 1
Reasons for B: Simplicity: Gateway VPC endpoints are easier to configure and manage compared to interface VPC endpoints. Cost: Gateway VPC endpoints are free to use, whereas interface VPC endpoints incur costs for each hour and per GB of data processed. Performance: Gateway VPC endpoints are highly scalable and optimized for S3 and DynamoDB traffic.
chir827389_3
👍 1
Selected: A
gateway endpoint does not have any SG.
certifiedlegend
👍 1
Selected: B
A VPC gateway endpoint is primarily used for accessing specific AWS services like Amazon S3 and DynamoDB privately within your VPC by specifying a route in your route table, while a VPC interface endpoint offers more flexible connectivity to a wider range of AWS services through AWS PrivateLink, allowing access from both within your VPC and from other VPCs using peering or Transit Gateways, typically with a dedicated private IP address within your VPC network; essentially, gateway endpoints are simpler and often free, while interface endpoints provide greater control and may incur additional costs depending on usage. Gateway endpoints are ideal for simple private access to S3 and DynamoDB, while interface endpoints are better suited for more complex scenarios where you need to access various AWS services from different VPCs or on-premises networks.
DeliKadir
👍 1
Selected: A
Even though Amazon S3 typically uses a Gateway VPC Endpoint, AWS now provides Interface VPC Endpoints for Amazon S3 as well via AWS PrivateLink....and "Attach a security groups to a gateway endpoint." makes the option B - false
FlyingHawk
👍 1
Selected: A
B will be correct if removing the "Attach appropriate security group to the endpoint" and gateway point is free of charge.
MaxMingxing
👍 1
Selected: B
Option A uses an interface VPC endpoint, which is typically used for services that require a private IP address within your VPC. For S3, a gateway VPC endpoint is more appropriate and cost-effective1
hilker1983
👍 1
Selected: B
Interface VPC Endpoint: Interface endpoints are generally used for other AWS services and do not provide the same direct access optimization for S3 that gateway endpoints do.
LizavetaD
👍 1
Selected: B
In this context, a Gateway VPC Endpoint is the correct choice for S3, as it provides direct, private access to S3 and routes traffic internally within the AWS networ
dipenich
👍 1
Selected: B
Why Option B is Correct: Gateway VPC Endpoint for Amazon S3: S3 does not require an interface endpoint; it uses a gateway VPC endpoint. Gateway endpoints ensure that requests stay within the AWS network, meeting the requirement of no public internet routes. Resource Policy: Attaching a bucket policy ensures that only the EC2 instance's IAM role has access to the bucket. Appropriate Security Controls: The gateway endpoint can be secured further using policies and security group configurations.
ARV14
👍 1
Selected: A
It is A. Gateway endpoint route table. Interface endpoint uses security groups and private link. See aws video https://youtu.be/TqApkvJx5hw?si=9Gpk3V7OcPU6MVJI
SteveNguyen
👍 1
Selected: B
gateway VPC endpoint is used for connect from VPC to S3 and DynamoDB
FlyingHawk
👍 4
Selected: A
You might initially lean toward Option B since a gateway endpoint is generally the preferred solution for EC2 instances in the same region. It’s cost-effective (free), performance-optimized, and simpler to configure. However, for the exam, technical precision in details is crucial. Option B is incorrect because: Gateway VPC endpoints are created at the VPC level, not at the Availability Zone level. Security groups must be attached to the EC2 instance (the source service) to allow outbound traffic using the prefix list associated with the gateway endpoint. Due to these reasons, Option A is the correct answer. While not ideal in real-world scenarios for EC2 instances in the same region, it is technically accurate and satisfies the exam's requirements.
Garryg
👍 1
Selected: B
correct ans is B
jayessh
👍 2
you cannot attach a security group to a gateway VPC endpoint. Security groups can only be attached to interface VPC endpoints-- so option B is wrong Option A won’t work because an interface VPC endpoint for Amazon S3 is not supported. Amazon S3 only supports gateway VPC endpoints. Interface VPC endpoints are used for services that are powered by AWS PrivateLink, which is not applicable to S3. There is something wrong with options provided
JA2018
👍 1
https://www.examtopics.com/discussions/amazon/view/83857-exam-aws-certified-solutions-architect-associate-saa-c02/
MALEK00
👍 2
B have "Attach appropriate security groups to the endpoint" Gateway Endpoints: Provisions a gateway and must be used as a target in a route table (does not use security groups) so B is incorrect and A is correct$
Mish
👍 1
Selected: B
B. Create a gateway VPC endpoint for Amazon S3 in the Availability Zone where the EC2 instance is located. Attach appropriate security groups to the endpoint. Attach a resource policy to the S3 bucket to only allow the EC2 instance’s IAM role for access.
Cmtan
👍 1
Selected: A
Gateway endpoint for S3 Use Amazon S3 public IP addresses, while interface endpoint use private IP addresses from your VPC to access Amazon S3. As mentioned, no traffic is allowed through the public route, so ANS is A
bignatov
👍 2
Selected: A
I vote for A, because there is no option to attach security group for gateway vpc endpoint. Apart from that in most cases gateway endpoint is preferable for S3, but this little detail about the security group changes my answer for A. Gateway endpoints uses routing tables instead security groups.
OlehKom
👍 2
Selected: B
Interface VPC endpoints are more suited for services that require private connectivity via a network interface. For S3, a Gateway VPC Endpoint is more appropriate and cost-effective since it integrates at the route table level without requiring additional cost per endpoint.
SamDevNation
👍 1
Selected: A
its A, private equals interfsce. https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#types-of-vpc-endpoints-for-s3
AWS_Debu
👍 2
Answer Should be B. You can attached security group with VPC endpoint. This is not the point. For S3 you need to create gateway VPC endpoint not interface VPC endpoint.
tom_cruise
👍 1
Gateway endpoints do not enable AWS PrivateLink. So the answer is A.
sonlduet
👍 1
It's definitely A, B is wrong because we configure route table for Gateway VPC Endpoint, not security group or subnet
jatric
👍 2
Selected: B
Gateway endpoint would be sufficient here which is specifically for S3 and dynamo DB and don't incurr any charges. Interface VPC endpoint might be usefull if a scneario with cross region or on-premises connectivity within private VPC https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html
Hightower_IT
👍 2
Selected: A
The wording in B says create a gateway VPC endpoint in the AZ, surely it should say in the VPC...... L
ChymKuBoy
👍 1
Selected: A
A for sure
a7md0
👍 3
Selected: B
DynamoDB & S3 uses Gateway VPC endpoint (not interface)
Duckydoo
👍 4
Selected: A
You associate a gateway endpoint with a VPC and its subnets (so the prefix list can be added to the appropriate routing tables). You cannot specify an AZ or associate an SG when creating a gateway endpoint.
Rhydian25
👍 2
Selected: A
It must be Interface VPC endpoint. As the Gateway VPC endpoint requires a S3 pubilc IP address to work: https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html If the bucket has a public IP address, it means the bucket is publicy accessible, which is not the case here.
rohitph
👍 2
Selected: A
we cannot "Attach a security groups to a gateway endpoint."
lofzee
👍 2
im almost certain that the answers in this question are written slightly wrong. there is no reason (based on the question), for you to select A. Only EC2 needs access to S3, 99% of the time you'd use a gateway endpoint. Reasons you might use an interface endpoint are: - requirement of on-premise access to S3 - requirement of access from another VPC in another region using peering or transit gateway - requirement of using specific endpoint S3 DNS names - use of private IPs from your VPC to access S3 based on the above, i believe the answer to be B, its just written incorrectly with the addition of the security groups part.
ManikRoy
👍 1
Selected: A
Option A as security group is not applicable for Gateway end point.
Solomon2001
👍 1
Selected: A
Explanation: Option A: Interface VPC endpoint for Amazon S3 ensures that the data transfer between the EC2 instance and the S3 bucket stays within the AWS network, avoiding the public internet. By attaching a resource policy to the S3 bucket to only allow access from the EC2 instance's IAM role, you ensure that only the EC2 instance can upload data to the S3 bucket. Option B: Gateway VPC endpoint for Amazon S3 doesn't ensure that the data transfer stays within the AWS network; it can still use the public internet. Although you can attach security groups to the endpoint, it doesn't guarantee that the data transfer won't use public internet routes.
7ce90e0
👍 2
Selected: B
B. Interface endpoints are for private link and require ip address. gateway endpoints are for internal services and don't need ip address. https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/what-are-vpc-endpoints.html
MehulKapadia
👍 4
Selected: A
Option B is confusing but not after you see the fine-print. - User cannot create Gateway endpoint in any specific Availability Zone, User only specify under which VPC it needs to be created. - User do not select/attach security group to Gateway Endpoint, as this gateway only works be adding destination prefix list(S3) to gateway endpoint route. Correct Answer: A
NishantM
👍 1
Answer B What is VPC gateway endpoint Consider a scenario where you have to access S3 from your EC2 instance in a public subnet. As the subnet has an internet gateway attached, the traffic to S3 will go through the public internet. However, the problem arises if your instance is in a private subnet and does not have any NAT gateway/instance attached or you cannot afford charges of NAT gateway. Currently, AWS S3 and DynamoDB are the only services supported by gateway endpoints. Using Gateway endpoints does not incur any data processing or hourly charges.
scar0909
👍 1
Selected: B
vpc gateway endpoint
TheFivePips
👍 1
Selected: A
I used to think that gatway endpoints were only for s3 and dynamodb, but I guess thats not the whole story. S3 can use interface endpoints, and they are privately routed. https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#types-of-vpc-endpoints-for-s3
frmrkc
👍 3
Selected: A
Option B is wrong: - you cannot attach security groups to gateway VPC endpoint - you cannot create gateway VPC endpoint in the Availability Zone
thewalker
👍 1
Selected: B
The main difference between an interface VPC endpoint and a gateway VPC endpoint is how traffic is routed to AWS services outside the VPC: Interface VPC Endpoint: Uses an Elastic Network Interface (ENI) within your VPC subnets to allow communication between your VPC and AWS services. When you create an interface endpoint, a private IP address is assigned to the ENI that acts as the entry point for traffic destined to the AWS service. DNS queries for the service are routed to the private IP address of the ENI, avoiding the public internet.
thewalker
👍 2
Gateway VPC Endpoint: Adds an entry in your VPC route table that defines the service as a valid destination and routes traffic to it. Traffic destined for the service leaves your VPC and travels across the AWS global network to the service. Gateway endpoints currently only support S3 and DynamoDB. Interface endpoints support many more AWS services. Some key points to consider when choosing an endpoint type include availability of the service, need for cross-region access, and whether traffic needs to flow from on-premises.
Charumathi
👍 1
Selected: A
Interface Endpoints are used for accessing AWS services within the same region over the AWS PrivateLink network, while Gateway Endpoints are used for providing private connectivity to specific AWS services outside your VPC. Each serves a distinct purpose based on the type of service and the desired network architecture.
prudhvi08
👍 1
Answer should be B https://k21academy.com/amazon-web-services/aws-solutions-architect/aws-gateway-endpoints/
ThongHM
👍 1
Selected: A
I choose A because this phrase "no API calls and no data are routed through PUBLIC INTERNET routes" You can use two types of VPC endpoints to access Amazon S3: gateway endpoints and interface endpoints (by using AWS PrivateLink). A gateway endpoint is a gateway that you specify in your route table to access Amazon S3 from your VPC over the AWS network. Interface endpoints extend the functionality of gateway endpoints by using PRIVATE IP addresses to route requests to Amazon S3 from within your VPC, on premises, or from a VPC in another AWS Region by using VPC peering or AWS Transit Gateway. https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html
awsgeek75
👍 1
Selected: A
Both A and B are close. I prefer A but B also seems to work as both have configurable security and limit traffic to within AWS network. I don't have a test account now but for Gateway end-point, I suspect that the security group will force you to allow traffic on public IP. https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html#gateway-endpoint-security https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html#gateway-endpoint-security
pentium75
👍 3
Selected: A
B is wrong because question does NOT ask that no data is "transferred over public Internet", it asks that no data is "routed through public internet routes (!)". Gateway VPC Endpoint uses public IP, thus from VPC perspective the traffic would hit a "public internet route", even if AWS would route the traffic internally. Besides, you don't create a Gateway VPC endpoint 'in an Availability Zone'.
jAtlas7
👍 1
Selected: B
Voting B (use gateway endpoint) on the basis that, to enable private connection between VPC and S3, one may either: option 1: interface VPC endpoint -> AWS PrivateLink -> S3 option 2: gateway VPC endpoint -> S3 i.e. Answer A (interface endpoint) would have been ok if it mentions the use of PrivateLink - unfortunately answer A doesn't mention PrivateLink. Answer B (interface endpoint) is basically option 1 - and therefore Answer B appears to be best answer. Ref: https://aws.amazon.com/blogs/architecture/choosing-your-vpc-endpoint-strategy-for-amazon-s3/
ale_brd_111
👍 1
Selected: A
Answer is A, Option B is wrong as with Gateway Endpoint you need to set up also the Route Table to use to reach the endpoint resource (S3 or DynamoDB) and not the security groups.
osmk
👍 1
https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html#gateway-endpoint-considerations-s3 The rules for the security groups for your instances that access Amazon S3 through a gateway endpoint must allow traffic to and from Amazon S3. You can reference the ID of the prefix list for Amazon S3 in security group rules.
v_rainbow
👍 3
Selected: A
While gateway endpoints also provide private connectivity, they are designed to be used by multiple resources within the VPC. This adds complexity and is not necessary for this scenario where only one EC2 instance needs access.
ansagr
👍 1
Selected: A
You cannot attach security groups to VPC gateway endpoints. For VPC gateway endpoints (like S3 or DynamoDB), you typically rely on route tables and IAM policies for access control.
MiniYang
👍 1
Selected: A
When you need to ensure that only specific Amazon EC2 instances can access your Amazon S3 bucket, but do not allow data to be routed over the public internet, you can consider the following two key concepts: VPC Endpoint:VPC endpoints are a way for EC2 instances to privately communicate with AWS services within your virtual private cloud (VPC). For Amazon S3, you can create an interface VPC endpoint, which allows EC2 instances to access S3 directly through a network connection within the VPC instead of going through the public Internet. IAM roles and S3 access control:You can use AWS Identity and Access Management (IAM) to control EC2 instance access to S3 buckets. You can grant EC2 instances access to S3 by assigning them specific IAM roles. At the same time, you can set a resource policy (Resource Policy) on the S3 bucket to only allow specific IAM roles or specific EC2 instances to access.
MiniYang
👍 1
Selected: A
This method creates a VPC endpoint in a specific subnet, ensuring that only EC2 instances in that subnet can access S3 through the VPC endpoint. This approach ensures more precise control that only EC2 instances in a specific subnet can upload data to S3, while also complying with the requirement that it not be routed through the public Internet.
lucasbg
👍 1
Definitly A since you cant attach a security group to a gateway endpoint, only to an ENI.
Marco_St
👍 1
Selected: A
I voted A since the question did not mention LEAST cost operation. interface VPC endpoint can be used for most services while it is not free. Gateway VPC endpoint is free and only for S3 and AWS DynamoDB. But Gateway Endpoint is not using security group to control the access, it is using route table. Security group is required for interface VPC endpoint which provides an ENI and needs security group. So A
ivan_riqueros12
👍 1
Selected: B
B. The endpoint should also be configured with appropriate security groups to allow access to the S3 bucket
Phoese
👍 1
Option B B. Create a gateway VPC endpoint for Amazon S3 in the Availability Zone where the EC2 instance is located. Attach appropriate security groups to the endpoint. Attach a resource policy to the S3 bucket to only allow the EC2 instance’s IAM role for access. This solution ensures that the traffic between the EC2 instance and S3 bucket does not leave the Amazon network, meeting the company's requirement for no data to be routed through the public internet. The use of security groups and resource policies ensures that only the specified EC2 instance has access to the S3 bucket.
Wayne23Fang
👍 1
Selected: B
But first phrase in (A) is wrong: Interface Endpoint doesn't work for the case.
Ramdi1
👍 1
Selected: B
Gateway VPC endpoints provide reliable connectivity to Amazon S3 and DynamoDB without requiring an internet gateway or a NAT device for your VPC
vijaykamal
👍 1
Selected: A
Option B mentions creating a gateway VPC endpoint for Amazon S3, but gateway endpoints are primarily used for routing traffic to Amazon S3 over Direct Connect or VPN connections, and they don't support attaching security groups. It's also essential to restrict access with a resource policy on the S3 bucket, which is not mentioned in option B. Options C and D suggest alternative approaches using DNS resolution and VPC route tables, but these options may not provide the same level of security and isolation as the interface VPC endpoint in option A. Additionally, these options are more complex to set up and maintain.
Mandar15
👍 1
Selected: A
https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#types-of-vpc-endpoints-for-s3
elmyth
👍 2
interface VPC endpoint is A))))
JKevin778
👍 2
Selected: B
Gateway Endpoint for S3 and DynamoDB, So B
Guru4Cloud
👍 2
Selected: B
B is the correct answer. To meet the requirements of no public internet access and only allowing the EC2 instance access, the solution is to: Create a gateway VPC endpoint for S3 in the subnet where the EC2 instance is located. This keeps S3 access within the VPC and does not route via the internet. Attach appropriate security groups to the endpoint to control access. Use a S3 bucket resource policy to only allow access from the EC2 instance IAM role.
TariqKipkemei
👍 1
Selected: A
You can provision interface endpoints for s3. https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#:~:text=With-,AWS%20PrivateLink,-for%20Amazon%20S3
5ab5e39
👍 1
B is correct,The outbound rules for the security group for instances that access Amazon S3 through the gateway endpoint must allow traffic to Amazon S3. You can use the prefix list ID for Amazon S3 as the destination in the outbound rule.
JustEugen
👍 1
Yes, but only if you need to use the PrivateLink
ukivanlamlpi
👍 2
Selected: B
nothing call interface VPC endpoint for s3, only gateway interface VPC for s3
skh015
👍 1
Interface endpoint exists https://youtu.be/TqApkvJx5hw
A1975
👍 2
Both the Interface Endpoint and Gateway Endpoint are forms of VPC Endpoint. The earlier is located inside a subnet and connected to a security group; the subsequent is located inside a VPC and connected to a routing table.
aadityaravi8
👍 2
you cannot directly attach security groups to VPC endpoints in AWS. Hence Option A is the right choice.
minkian_
👍 1
Selected: A
정답은 A 입니다 게이트웨이 엔드포인트는 Private Link 를 지원하지 않습니다 https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#types-of-vpc-endpoints-for-s3
darren_song
👍 4
Selected: B
Please refer to the following documents : https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/what-are-vpc-endpoints.html https://repost.aws/knowledge-center/connect-s3-vpc-endpoint https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html https://digitalcloud.training/vpc-interface-endpoint-vs-gateway-endpoint-in-aws/
Mia2009687
👍 3
Selected: B
There is no additional charge for using gateway endpoints. Amazon S3 supports both gateway endpoints and interface endpoints. With a gateway endpoint, you can access Amazon S3 from your VPC, without requiring an internet gateway or NAT device for your VPC, and with no additional cost. However, gateway endpoints do not allow access from on-premises networks, from peered VPCs in other AWS Regions, or through a transit gateway. For those scenarios, you must use an interface endpoint, which is available for an additional cost. The topic mentioned no API or other public network service should access to S3. So Gateway endpoint should be better.
cookieMr
👍 2
Selected: A
By creating an interface VPC endpoint for Amazon S3 in the same subnet as the EC2 instance, the data transfer between the EC2 instance and S3 can occur privately within the Amazon network, without traversing the public internet. This ensures secure and direct communication between the EC2 instance and S3. Attaching a resource policy to the S3 bucket that allows access only from the IAM role associated with the EC2 instance further restricts access to only the authorized instance. B. Creating a gateway VPC endpoint for Amazon S3 would still involve routing through the public internet, which is not desired in this case. C. Running nslookup or creating a specific route in the VPC route table does not provide the desired level of security and privacy, as the traffic may still traverse public internet routes. D. Using the publicly available ip-ranges.json file to obtain the private IP address of the S3 bucket's service API endpoint is not a recommended approach, as IP addresses can change over time, and it does not provide the same level of security as using VPC endpoints.
abhishek2021
👍 1
Selected: A
security group cannot be associated with Gateway Endpoint. so, the answer is A.
smartegnine
👍 3
Selected: B
https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html Create a security group that allows the resources in your VPC to communicate with the endpoint network interfaces for the VPC endpoint. To ensure that tools such as the AWS CLI can make requests over HTTPS from resources in the VPC to the AWS service, the security group must allow inbound HTTPS traffic. For Security groups, select the security groups to associate with the endpoint network interfaces for the VPC endpoint. By default, we associate the default security group for the VPC.
slackbot
👍 5
this is valid for interface endpoint, not for gateway endpoint, which option B mentioned
Peng001
👍 3
Selected: B
You cannot use Interface Endpoint for S3 or DynamoDB. It has to bee the Gateway endpoints. See the diagram: https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/what-are-vpc-endpoints.html
ErnShm
👍 1
It's absolutely A, security group can't be attached to the VPC Endpoint gateway
Abhineet9148232
👍 2
Selected: A
ChatGPT: Option B is not the best solution because it involves creating a gateway VPC endpoint for Amazon S3. Gateway VPC endpoints only support Amazon S3 and DynamoDB and do not support private DNS. This means that requests to the S3 bucket would still be routed over the internet. On the other hand, an interface VPC endpoint, as described in option A, supports private DNS and allows traffic between the VPC and the service to remain within the Amazon network. This ensures that no API calls and no data are routed through public internet routes.
ruqui
👍 2
that answer is completely wrong!!!! Don't rely on ChatGPT, use the documentation available and think yourself. Reference: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html (look into 'Considerations' section)
Guru4Cloud
👍 2
it is possible - you should do more reading
markw92
👍 10
Gateway endpoint must be used as a target in a route table does not use security groups.
smartegnine
👍 2
Create a security group that allows the resources in your VPC to communicate with the endpoint network interfaces for the VPC endpoint. To ensure that tools such as the AWS CLI can make requests over HTTPS from resources in the VPC to the AWS service, the security group must allow inbound HTTPS traffic. For Security groups, select the security groups to associate with the endpoint network interfaces for the VPC endpoint. By default, we associate the default security group for the VPC.
datz
👍 3
Selected: B
Answer: B What is VPC gateway endpoint Consider a scenario where you have to access S3 from your EC2 instance in a public subnet. As the subnet has an internet gateway attached, the traffic to S3 will go through the public internet. However, the problem arises if your instance is in a private subnet and does not have any NAT gateway/instance attached or you cannot afford charges of NAT gateway. Currently, AWS S3 and DynamoDB are the only services supported by gateway endpoints. Using Gateway endpoints does not incur any data processing or hourly charges. https://digitalcloud.training/vpc-interface-endpoint-vs-gateway-endpoint-in-aws/
Steve_4542636
👍 2
Selected: A
https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#types-of-vpc-endpoints-for-s3. Gateway endpoints use public s3 ip addresses
slackbot
👍 10
interface endpoint exists for S3 as well
kerl
👍 2
Answer is A is correct. U cannot attaach security group to Gateway Endpoint. Note that Gateway Endpoint do not create ENI in your subnet, hence no Security group can be attached. You can create IAM policy to allow only IAM Role to access to AWS. (https://aws.amazon.com/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/)
JohnnyBG
👍 1
Selected: A
A - Because we can not configure a SG on an gateway endpoint https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html
aba2s
👍 1
Selected: A
Interface Endpoint use private IP adresses from VPC to acces S3. IE use private AWS PrivateLink
Omok
👍 8
In support, see https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#types-of-vpc-endpoints-for-s3
Bofi
👍 1
You can access Amazon S3 from your VPC using gateway VPC endpoints. After you create the gateway endpoint, you can add it as a target in your route table for traffic destined from your VPC to Amazon S3. Reason for B is absolutely wrong
Mahadeva
👍 1
Even Interface VPC endpoint can be use to access service such as S3 or SNS outside of the VPC. The reasoning in Option B is not correct.
Zerotn3
👍 1
Selected: A
The correct answer is A. Create an interface VPC endpoint for Amazon S3 in the subnet where the EC2 instance is located. Attach a resource policy to the S3 bucket to only allow the EC2 instance’s IAM role for access. A VPC endpoint allows you to create a private connection between your VPC and another service without requiring access over the internet, a NAT device, or a VPN connection. An interface VPC endpoint is a network interface that you can create in your VPC that serves as an entry point for incoming traffic. You can use an interface VPC endpoint to access resources in the service, such as an Amazon S3 bucket.
Zerotn3
👍 1
Attaching a resource policy to the S3 bucket allows you to specify which IAM entities are allowed to access the bucket and what actions they can perform on the bucket and its contents. In this case, you can specify that only the EC2 instance’s IAM role has access to the bucket. Option B is incorrect because a gateway VPC endpoint is used to access resources outside of the VPC, such as an on-premises data center. It is not used to access resources within the VPC. Option C is incorrect because the nslookup tool is used to find the IP address associated with a domain name. It is not used to obtain the private IP address of the S3 bucket’s service API endpoint. Option D is incorrect because the ip-ranges.json file contains the IP address ranges for all AWS services. It does not contain the private IP address of the S3 bucket’s service API endpoint. Additionally, using a publicly available IP address range to create a route in the VPC route table would not meet the requirement to ensure that no data is routed through public internet routes.
Mimikabs
👍 3
Selected: A
From what I understand, you can create security groups for interface endpoints because they use an ENI, but you cannot create security groups for gateway endpoints as they do not use ENIs. So I would go with A
ChrisG1454
👍 35
There are two types VPC Endpoint: Gateway endpoint Interface endpoint A Gateway endpoint: 1) Helps you to securely connect to Amazon S3 and DynamoDB 2) Endpoint serves as a target in your route table for traffic 3) Provide access to endpoint (endpoint, identity and resource policies) An Interface endpoint: 1) Help you to securely connect to AWS services EXCEPT FOR Amazon S3 and DynamoDB 2) Powered by PrivateLink (keeps network traffic within AWS network) 3) Needs a elastic network interface (ENI) (entry point for traffic)
mhmt4438
👍 7
An interface VPC endpoint does provide a direct connection between the EC2 instance and the S3 bucket. It enables private communication between instances in your VPC and resources in other services without requiring an internet gateway, a NAT device, or a VPN connection. Option A , which recommends creating an interface VPC endpoint for Amazon S3 in the subnet where the EC2 instance is located and attaching a resource policy to the S3 bucket to only allow the EC2 instance's IAM role for access, is the correct solution for the given scenario. It meets the requirement to ensure that no API calls and no data are routed through public internet routes and that only the EC2 instance can have access to upload data to the S3 bucket.
Buruguduystunstugudunstuy
👍 38
Selected: B
The correct solution to meet the requirements is Option B. A gateway VPC endpoint for Amazon S3 should be created in the Availability Zone where the EC2 instance is located. This will allow the EC2 instance to access the S3 bucket directly, without routing through the public internet. The endpoint should also be configured with appropriate security groups to allow access to the S3 bucket. Additionally, a resource policy should be attached to the S3 bucket to only allow the EC2 instance's IAM role for access.
JA2018
👍 1
check this out: https://www.examtopics.com/discussions/amazon/view/83857-exam-aws-certified-solutions-architect-associate-saa-c02/ Selected answer: B So which is the correct answer?!!!!
Buruguduystunstugudunstuy
👍 4
Option A is incorrect because an interface VPC endpoint for Amazon S3 would not provide a direct connection between the EC2 instance and the S3 bucket. Option C is incorrect because using the nslookup tool to obtain the private IP address of the S3 bucket's service API endpoint would not provide a secure connection between the EC2 instance and the S3 bucket. Option D is incorrect because using the ip-ranges.json file to obtain the private IP address of the S3 bucket's service API endpoint is not a secure method to connect the EC2 instance to the S3 bucket.
amsimann
👍 1
B is wrong as it is not created in just an AZ, but specifically in a VPC
romko
👍 3
Selected: A
Both (Gateway and Interface) VPC endpoints allow to access S3 privately over AWS network. VPC gateway usually is preferred when private access to S# is needed form EC2 in some VPC, because it free of charge, easy to set up and scalable. To setup properly access via gateway VPC endpoint is required to edit route tables, but in answer choice it's not mentioned, so without it connection will not work. So by elimination we may select A as correct answer.
Mahadeva
👍 1
Similarly to enable interface VPC endpoint, the Security Group must be attached, which is not mentioned in Option A. Actually both interface and gateway VPC endpoints can access AWS service outside of VPC.
Iconique
👍 2
Go to console and test it yourself! With Interface Endpoint you can add security groups.
kruasan
👍 3
No, it’s not
career360guru
👍 1
Selected: A
A Interface endpoint is the right answer. B is incorrect because though VPC endpoint keep the traffic within Amazon network, it will use S3 Public IP address which may not be acceptable in this case.
career360guru
👍 2
I stated it incorrectly. B that says VPC Gateway end point is the right answer.
NikaCZ
👍 1
Selected: A
Correct is: Create an interface VPC endpoint for Amazon S3 in the subnet where the EC2 instance is located. Attach a resource policy to the S3 bucket to only allow the EC2 instance’s IAM role for access. WHY: EC2 instance access S3 bucket directly over the AWS network without routing data over the public internet. VPC endpoint helps you to securely connect your VPC to another service.
Shasha1
👍 1
A Option A allow the EC2 instance to access the S3 bucket directly over the AWS network without routing data over the public internet. Option B is not correct because a gateway VPC endpoint for Amazon S3 will not provide the EC2 instance with direct access to the S3 bucket over the AWS network. Instead, a gateway VPC endpoint will route data over the public internet, which is not allowed in this scenario.
KADSM
👍 2
VPC endpoints (Gateway or Interface) will not allow the data to traverse through internet.
DWISE1
👍 3
VPC Endpoint helps you to securely connect your VPC to another service. There are two types Gateway endpoint Interface endpoint A Gateway endpoint: Help you to securely connect to Amazon S3 and DynamoDB Endpoint serves as a target in your route table for traffic Provide access to endpoint (endpoint, identity and resource policies) An Interface endpoint:
JCH760310
👍 1
I'm confused: see question #4 - gateway VPC endpoint
SSASSWS
👍 42
Selected: A
I think answer should be A and not B. as we cannot "Attach a security groups to a gateway endpoint."
A_New_Guy
👍 5
It's possible: https://aws.amazon.com/premiumsupport/knowledge-center/connect-s3-vpc-endpoint/
mj98
👍 2
no SG for gateway
jambajuice
👍 3
Selected: A
Answer A . Gateway endpoint doent support Security group.
A_New_Guy
👍 2
It's support it: https://aws.amazon.com/premiumsupport/knowledge-center/connect-s3-vpc-endpoint/
leonnnn
👍 1
Selected: A
I choose A
leonnnn
👍 1
I think it's B after some more considering.
Nigma
👍 3
Selected: B
Answer : B
kmliuy73
👍 1
Provisions a gateway and must be used as a target in a route table (does not use security groups)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A creates an interface VPC endpoint for Amazon S3 in the subnet where the EC2 instance runs, which uses AWS PrivateLink so both API calls and data traverse AWS's private network rather than public internet routes. Interface endpoints are ENI-based resources that live in a specific subnet and accept security-group attachment, so the described configuration is technically valid. The attached S3 bucket resource policy that allows only the EC2 instance's IAM role satisfies the requirement that only that instance can upload. AWS documents exactly this interface (PrivateLink) endpoint pattern for S3 in the Amazon S3 user guide, as Omok linked.Official Reference
Exam Strategy
Read endpoint options literally — if an option attaches security groups to a gateway endpoint or claims a gateway endpoint is created per Availability Zone, it is wrong regardless of the overall design. When a question demands that traffic never leave the AWS network, confirm the option names an interface (PrivateLink) or gateway endpoint rather than routes to published service IP ranges.
Frequently Asked Questions
Why is a gateway VPC endpoint for S3 not the right pick in this question?
Option B describes a gateway endpoint as being created per Availability Zone and attaching security groups, but gateway endpoints are VPC-level route-table targets and support no security groups. The flawed wording makes B invalid.
Why can't I route to S3 using ip-ranges.json or nslookup addresses?
S3's published service IP ranges are public internet addresses, so routing to them still sends traffic over public internet routes. Private connectivity requires a VPC endpoint instead.
Related Analysis
Practice All SAA-C03 Questions
Access 120 questions with complete answers and detailed explanations.
View Full SAA-C03 Practice Test →