How to Reach S3 from a Private Subnet Without Internet?

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources. Design cost-optimized network architectures.

Short answer

B Configure an S3 gateway endpoint and update the VPC route table so the application's S3 traffic stays on the AWS network, avoiding internet traversal at no endpoint cost.

Question

A company runs an application in a private subnet behind an Application Load Balancer (ALB) in a VPC. The VPC has a NAT gateway and an internet gateway. The application calls the Amazon S3 API to store objects. According to the company's security policy, traffic from the application must not travel across the internet. Which solution will meet these requirements MOST cost-effectively?
  1. Configure an S3 interface endpoint. Create a security group that allows outbound traffic to Amazon S3.
  2. Configure an S3 gateway endpoint. Update the VPC route table to use the endpoint. Correct Answer
  3. Configure an S3 bucket policy to allow traffic from the Elastic IP address that is assigned to the NAT gateway.
  4. Create a second NAT gateway in the same subnet where the legacy application is deployed. Update the VPC route table to use the second NAT gateway.

Key Takeaways

Tests which VPC endpoint type keeps S3 traffic off the internet at the lowest cost; the trap is choosing the S3 interface endpoint, which is secure but bills hourly per Availability Zone plus per GB processed.

A private-subnet application that must call the Amazon S3 API without internet traffic should use an S3 gateway endpoint attached to the VPC route table. This page confirms why that option (B) satisfies both the security policy and the lowest-cost requirement, unlike an interface endpoint or a second NAT gateway.

Common mistake: Picking the S3 interface endpoint (A) because PrivateLink automatically sounds more secure, missing that gateway endpoints are free while interface endpoints add hourly and data-processing charges.

Expert Analysis

Why the Answer Is Correct

An S3 gateway endpoint is a route-table target that associates an AWS-managed prefix list for Amazon S3 with the private subnet's route table, so packets from the application to S3 never leave the AWS network. Because the traffic is routed internally, it does not pass through the NAT gateway or the internet gateway, which directly satisfies the security policy that traffic must not travel across the internet. Gateway endpoints for S3 and DynamoDB carry no hourly charge and no per-GB data-processing charge, making option B the most cost-effective solution as well. The ALB is irrelevant to the S3 API calls, so no other architectural change is needed.

Why the Other Options Are Wrong

Option A does work functionally: an S3 interface endpoint uses AWS PrivateLink and keeps traffic off the internet, but it is billed per AZ per hour plus per GB of data processed, so it is not the most cost-effective choice here. Option C is fundamentally broken, because a bucket policy keyed to the NAT gateway's Elastic IP still means the requests traverse the internet through the NAT gateway and internet gateway, and a bucket policy cannot guarantee an internal path. Option D adds a second NAT gateway, which duplicates hourly and data-processing NAT charges while still sending S3 traffic over the internet, failing both requirements. Only the gateway endpoint satisfies the no-internet constraint at zero endpoint cost.

Community Comment Notes

Community consensus was unanimous for option B. sOI852POL pointed at the official VPC endpoint page for Amazon S3, and trinh_le offered a useful shortcut: when an instance connects to S3, think "VPC endpoint or S3 endpoint" rather than NAT. GOTJ reinforced the cost angle by sharing the AWS architecture blog on choosing a VPC endpoint strategy, and aragon_saa simply confirmed "Answer is B". No commenter defended option A on cost grounds, which matches the fact that interface endpoints are metered.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a stem says a private subnet must reach Amazon S3 and traffic must not cross the internet, the gateway endpoint is almost always the intended answer. Add the "MOST cost-effectively" keyword and gateway endpoint wins outright over interface endpoints and extra NAT gateways, since gateway endpoints have no hourly or data-processing fee.

Frequently Asked Questions

Why is an S3 interface endpoint not the most cost-effective choice here?

It also keeps traffic off the internet via PrivateLink, but it is billed hourly per Availability Zone plus per GB processed, while the S3 gateway endpoint is free.

Does an S3 gateway endpoint need a security group to allow outbound traffic?

No. Gateway endpoints are route-table targets, not ENIs, so access is controlled by endpoint policies and bucket policies rather than security groups.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. sOI852POL 👍 5 Answered B
    S3 gateway endpoint https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html
  2. trinh_le 👍 3 Answered B
    Keyword: ec2 connect s3 -> vpc endpoint or s3 endpoint
  3. GOTJ 👍 2 Answered B
    Here's another document that support option "B" as the most cost-effectively: https://aws.amazon.com/blogs/architecture/choosing-your-vpc-endpoint-strategy-for-amazon-s3/
  4. aragon_saa 👍 2 Answered B
    Answer is B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide