Private S3 Upload from EC2 Without Public Internet

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources. Determine high-performing and/or scalable network architectures.

Short answer

A Create an interface VPC endpoint for Amazon S3 in the EC2 instance's subnet and lock the bucket policy to that instance's IAM role.

Question

A company needs to move data from an Amazon EC2 instance to an Amazon S3 bucket. The company must ensure that no API calls and no data are routed through public internet routes. Only the EC2 instance can have access to upload data to the S3 bucket.
Which solution will meet these requirements?
  1. Create an interface VPC endpoint for Amazon S3 in the subnet where the EC2 instance is located. Attach a resource policy to the S3 bucket to only allow the EC2 instance’s IAM role for access. Correct Answer
  2. Create a gateway VPC endpoint for Amazon S3 in the Availability Zone where the EC2 instance is located. Attach appropriate security groups to the endpoint. Attach a resource policy to the S3 bucket to only allow the EC2 instance’s IAM role for access.
  3. Run the nslookup tool from inside the EC2 instance to obtain the private IP address of the S3 bucket’s service API endpoint. Create a route in the VPC route table to provide the EC2 instance with access to the S3 bucket. Attach a resource policy to the S3 bucket to only allow the EC2 instance’s IAM role for access.
  4. Use the AWS provided, publicly available ip-ranges.json file to obtain the private IP address of the S3 bucket’s service API endpoint. Create a route in the VPC route table to provide the EC2 instance with access to the S3 bucket. Attach a resource policy to the S3 bucket to only allow the EC2 instance’s IAM role for access.

Key Takeaways

The question tests which VPC endpoint type for S3 keeps API calls and data off the public internet while still supporting the required network-level controls — and the trap is picking the gateway endpoint option that misdescribes its placement and its security-group support.

This SAA-C03 scenario asks how an EC2 instance can reach an Amazon S3 bucket entirely over private AWS networking while restricting upload rights to that instance's IAM role. The correct design is an interface VPC endpoint for S3 in the instance's subnet combined with a bucket policy that allows only the EC2 instance's IAM role.

Common mistake: Option B is the most-chosen wrong answer because a gateway endpoint is the 'classic' free S3 path, but it is created at the VPC level (not 'in an Availability Zone') and gateway endpoints cannot have security groups attached — only route-table and endpoint policies apply.

Expert Analysis

Why the Answer Is Correct

Option A creates an interface VPC endpoint for Amazon S3 in the subnet where the EC2 instance runs, which uses AWS PrivateLink so both API calls and data traverse AWS's private network rather than public internet routes. Interface endpoints are ENI-based resources that live in a specific subnet and accept security-group attachment, so the described configuration is technically valid. The attached S3 bucket resource policy that allows only the EC2 instance's IAM role satisfies the requirement that only that instance can upload. AWS documents exactly this interface (PrivateLink) endpoint pattern for S3 in the Amazon S3 user guide, as Omok linked.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Read endpoint options literally — if an option attaches security groups to a gateway endpoint or claims a gateway endpoint is created per Availability Zone, it is wrong regardless of the overall design. When a question demands that traffic never leave the AWS network, confirm the option names an interface (PrivateLink) or gateway endpoint rather than routes to published service IP ranges.

Frequently Asked Questions

Why is a gateway VPC endpoint for S3 not the right pick in this question?

Option B describes a gateway endpoint as being created per Availability Zone and attaching security groups, but gateway endpoints are VPC-level route-table targets and support no security groups. The flawed wording makes B invalid.

Why can't I route to S3 using ip-ranges.json or nslookup addresses?

S3's published service IP ranges are public internet addresses, so routing to them still sends traffic over public internet routes. Private connectivity requires a VPC endpoint instead.

More SAA-C03 FAQ →

Discussion 132 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 132

  1. SSASSWS 👍 42 Answered A
    I think answer should be A and not B. as we cannot "Attach a security groups to a gateway endpoint."
  2. Buruguduystunstugudunstuy 👍 38 Answered B
    The correct solution to meet the requirements is Option B. A gateway VPC endpoint for Amazon S3 should be created in the Availability Zone where the EC2 instance is located. This will allow the EC2 instance to access the S3 bucket directly, without routing through the public internet. The endpoint should also be configured with appropriate security groups to allow access to the S3 bucket. Additionally, a resource policy should be attached to the S3 bucket to only allow the EC2 instance's IAM role for access.
  3. ChrisG1454 👍 35
    There are two types VPC Endpoint: Gateway endpoint Interface endpoint A Gateway endpoint: 1) Helps you to securely connect to Amazon S3 and DynamoDB 2) Endpoint serves as a target in your route table for traffic 3) Provide access to endpoint (endpoint, identity and resource policies) An Interface endpoint: 1) Help you to securely connect to AWS services EXCEPT FOR Amazon S3 and DynamoDB 2) Powered by PrivateLink (keeps network traffic within AWS network) 3) Needs a elastic network interface (ENI) (entry point for traffic)
  4. markw92 👍 10
    Gateway endpoint must be used as a target in a route table does not use security groups.
  5. slackbot 👍 10
    interface endpoint exists for S3 as well
Show 25 more comments
  1. Omok 👍 8
    In support, see https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#types-of-vpc-endpoints-for-s3
  2. mhmt4438 👍 7
    An interface VPC endpoint does provide a direct connection between the EC2 instance and the S3 bucket. It enables private communication between instances in your VPC and resources in other services without requiring an internet gateway, a NAT device, or a VPN connection. Option A , which recommends creating an interface VPC endpoint for Amazon S3 in the subnet where the EC2 instance is located and attaching a resource policy to the S3 bucket to only allow the EC2 instance's IAM role for access, is the correct solution for the given scenario. It meets the requirement to ensure that no API calls and no data are routed through public internet routes and that only the EC2 instance can have access to upload data to the S3 bucket.
  3. A_New_Guy 👍 5
    It's possible: https://aws.amazon.com/premiumsupport/knowledge-center/connect-s3-vpc-endpoint/
  4. slackbot 👍 5
    this is valid for interface endpoint, not for gateway endpoint, which option B mentioned
  5. FlyingHawk 👍 4 Answered A
    You might initially lean toward Option B since a gateway endpoint is generally the preferred solution for EC2 instances in the same region. It’s cost-effective (free), performance-optimized, and simpler to configure. However, for the exam, technical precision in details is crucial. Option B is incorrect because: Gateway VPC endpoints are created at the VPC level, not at the Availability Zone level. Security groups must be attached to the EC2 instance (the source service) to allow outbound traffic using the prefix list associated with the gateway endpoint. Due to these reasons, Option A is the correct answer. While not ideal in real-world scenarios for EC2 instances in the same region, it is technically accurate and satisfies the exam's requirements.
  6. Buruguduystunstugudunstuy 👍 4
    Option A is incorrect because an interface VPC endpoint for Amazon S3 would not provide a direct connection between the EC2 instance and the S3 bucket. Option C is incorrect because using the nslookup tool to obtain the private IP address of the S3 bucket's service API endpoint would not provide a secure connection between the EC2 instance and the S3 bucket. Option D is incorrect because using the ip-ranges.json file to obtain the private IP address of the S3 bucket's service API endpoint is not a secure method to connect the EC2 instance to the S3 bucket.
  7. MehulKapadia 👍 4 Answered A
    Option B is confusing but not after you see the fine-print. - User cannot create Gateway endpoint in any specific Availability Zone, User only specify under which VPC it needs to be created. - User do not select/attach security group to Gateway Endpoint, as this gateway only works be adding destination prefix list(S3) to gateway endpoint route. Correct Answer: A
  8. darren_song 👍 4 Answered B
    Please refer to the following documents : https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/what-are-vpc-endpoints.html https://repost.aws/knowledge-center/connect-s3-vpc-endpoint https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html https://digitalcloud.training/vpc-interface-endpoint-vs-gateway-endpoint-in-aws/
  9. Duckydoo 👍 4 Answered A
    You associate a gateway endpoint with a VPC and its subnets (so the prefix list can be added to the appropriate routing tables). You cannot specify an AZ or associate an SG when creating a gateway endpoint.
  10. Mia2009687 👍 3 Answered B
    There is no additional charge for using gateway endpoints. Amazon S3 supports both gateway endpoints and interface endpoints. With a gateway endpoint, you can access Amazon S3 from your VPC, without requiring an internet gateway or NAT device for your VPC, and with no additional cost. However, gateway endpoints do not allow access from on-premises networks, from peered VPCs in other AWS Regions, or through a transit gateway. For those scenarios, you must use an interface endpoint, which is available for an additional cost. The topic mentioned no API or other public network service should access to S3. So Gateway endpoint should be better.
  11. datz 👍 3 Answered B
    Answer: B What is VPC gateway endpoint Consider a scenario where you have to access S3 from your EC2 instance in a public subnet. As the subnet has an internet gateway attached, the traffic to S3 will go through the public internet. However, the problem arises if your instance is in a private subnet and does not have any NAT gateway/instance attached or you cannot afford charges of NAT gateway. Currently, AWS S3 and DynamoDB are the only services supported by gateway endpoints. Using Gateway endpoints does not incur any data processing or hourly charges. https://digitalcloud.training/vpc-interface-endpoint-vs-gateway-endpoint-in-aws/
  12. smartegnine 👍 3 Answered B
    https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html Create a security group that allows the resources in your VPC to communicate with the endpoint network interfaces for the VPC endpoint. To ensure that tools such as the AWS CLI can make requests over HTTPS from resources in the VPC to the AWS service, the security group must allow inbound HTTPS traffic. For Security groups, select the security groups to associate with the endpoint network interfaces for the VPC endpoint. By default, we associate the default security group for the VPC.
  13. romko 👍 3 Answered A
    Both (Gateway and Interface) VPC endpoints allow to access S3 privately over AWS network. VPC gateway usually is preferred when private access to S# is needed form EC2 in some VPC, because it free of charge, easy to set up and scalable. To setup properly access via gateway VPC endpoint is required to edit route tables, but in answer choice it's not mentioned, so without it connection will not work. So by elimination we may select A as correct answer.
  14. pentium75 👍 3 Answered A
    B is wrong because question does NOT ask that no data is "transferred over public Internet", it asks that no data is "routed through public internet routes (!)". Gateway VPC Endpoint uses public IP, thus from VPC perspective the traffic would hit a "public internet route", even if AWS would route the traffic internally. Besides, you don't create a Gateway VPC endpoint 'in an Availability Zone'.
  15. DWISE1 👍 3
    VPC Endpoint helps you to securely connect your VPC to another service. There are two types Gateway endpoint Interface endpoint A Gateway endpoint: Help you to securely connect to Amazon S3 and DynamoDB Endpoint serves as a target in your route table for traffic Provide access to endpoint (endpoint, identity and resource policies) An Interface endpoint:
  16. v_rainbow 👍 3 Answered A
    While gateway endpoints also provide private connectivity, they are designed to be used by multiple resources within the VPC. This adds complexity and is not necessary for this scenario where only one EC2 instance needs access.
  17. Mimikabs 👍 3 Answered A
    From what I understand, you can create security groups for interface endpoints because they use an ENI, but you cannot create security groups for gateway endpoints as they do not use ENIs. So I would go with A
  18. Peng001 👍 3 Answered B
    You cannot use Interface Endpoint for S3 or DynamoDB. It has to bee the Gateway endpoints. See the diagram: https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/what-are-vpc-endpoints.html
  19. frmrkc 👍 3 Answered A
    Option B is wrong: - you cannot attach security groups to gateway VPC endpoint - you cannot create gateway VPC endpoint in the Availability Zone
  20. jambajuice 👍 3 Answered A
    Answer A . Gateway endpoint doent support Security group.
  21. a7md0 👍 3 Answered B
    DynamoDB & S3 uses Gateway VPC endpoint (not interface)
  22. kruasan 👍 3
    No, it’s not
  23. Nigma 👍 3 Answered B
    Answer : B
  24. cookieMr 👍 2 Answered A
    By creating an interface VPC endpoint for Amazon S3 in the same subnet as the EC2 instance, the data transfer between the EC2 instance and S3 can occur privately within the Amazon network, without traversing the public internet. This ensures secure and direct communication between the EC2 instance and S3. Attaching a resource policy to the S3 bucket that allows access only from the IAM role associated with the EC2 instance further restricts access to only the authorized instance. B. Creating a gateway VPC endpoint for Amazon S3 would still involve routing through the public internet, which is not desired in this case. C. Running nslookup or creating a specific route in the VPC route table does not provide the desired level of security and privacy, as the traffic may still traverse public internet routes. D. Using the publicly available ip-ranges.json file to obtain the private IP address of the S3 bucket's service API endpoint is not a recommended approach, as IP addresses can change over time, and it does not provide the same level of security as using VPC endpoints.
  25. lofzee 👍 2
    im almost certain that the answers in this question are written slightly wrong. there is no reason (based on the question), for you to select A. Only EC2 needs access to S3, 99% of the time you'd use a gateway endpoint. Reasons you might use an interface endpoint are: - requirement of on-premise access to S3 - requirement of access from another VPC in another region using peering or transit gateway - requirement of using specific endpoint S3 DNS names - use of private IPs from your VPC to access S3 based on the above, i believe the answer to be B, its just written incorrectly with the addition of the security groups part.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Scheduled scaling for a predictable morning EC2 traffic spike

S-grade

Improving RDS Performance with Provisioned IOPS SSD

S-grade

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide