How Can EC2 Reach Amazon S3 Without Using the Public Internet?

Why the Answer Is Correct

A gateway VPC endpoint for Amazon S3 attaches S3 to the VPC through the AWS private network, and the route-table entry for the S3 prefix list sends all S3-bound traffic to that endpoint instead of an internet gateway or NAT device. Because EC2 instances and S3 then communicate over private addressing, sensitive data never traverses the public internet, which is the exact requirement stated in the scenario. The endpoint also supports an endpoint policy, so access to the target bucket can be scoped to the VPC or to specific IAM principals, adding a security control on top of the private path. No public IPs, internet gateway, or NAT gateway are needed, and the solution costs nothing beyond normal S3 request charges. This is the canonical AWS pattern for private S3 access from a VPC.

Why the Other Options Are Wrong

Option B proposes an internal Network Load Balancer with the S3 bucket as a target, but Amazon S3 cannot be registered as an NLB target group; an NLB operates at Layer 4 for TCP/UDP endpoints such as EC2 instances, IP addresses, or Lambda, so this design is not technically possible. Option C claims an S3 bucket can be deployed inside a VPC, but S3 is a regional AWS service that exists outside customer VPCs and cannot be placed in a subnet or reached by a route to a bucket. Option D uses AWS Direct Connect, which is a dedicated private connection between an on-premises data center and AWS, not a mechanism for VPC-to-S3 traffic within the same Region, and it would also require additional infrastructure that the question does not mention.

Community Comment Notes

Every recorded voter selected option A, and the reasoning is consistent with the AWS documentation. As sandordini summarized, there is "no internet, S3 > gateway VPC endpoint", pointing directly at the private-path requirement. Mikado211 made the same link by quoting the question's own phrase, writing that "data cannot be sent over the public internet." == VPC Endpoint, and mk168898 repeated that a gateway VPC endpoint is the answer when internet access is disallowed. Scheldon and Awsbeginner87 simply logged A without further commentary, so no voter raised a credible objection to the gateway endpoint design.

Exam Strategy

When a question states that traffic must not traverse the public internet and the target is Amazon S3 (or DynamoDB), think 'gateway VPC endpoint plus route-table entry' before considering any appliance, load balancer, or hybrid-connectivity option. Eliminate answers that place an AWS managed service such as S3 inside a VPC or that target S3 from a load balancer, because those violate how the services actually work. Reserve Direct Connect and Site-to-Site VPN for scenarios that connect on-premises networks to AWS, not VPC-to-service traffic.