Direct Connect Public VIF for On-Premises S3 Access

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources. Design cost-optimized network architectures.

Short answer

A Use a Direct Connect public VIF so the on-premises application reaches Amazon S3 over the dedicated connection without internet access or interface endpoint charges.

Question

A company is expanding a secure on-premises network to the AWS Cloud by using an AWS Direct Connect connection. The on-premises network has no direct internet access. An application that runs on the on-premises network needs to use an Amazon S3 bucket.
Which solution will meet these requirements MOST cost-effectively?
  1. Create a public virtual interface (VIF). Route the AWS traffic over the public VIF. Correct Answer
  2. Create a VPC and a NAT gateway. Route the AWS traffic from the on-premises network to the NAT gateway.
  3. Create a VPC and an Amazon S3 interface endpoint. Route the AWS traffic from the on-premises network to the S3 interface endpoint.
  4. Create a VPC peering connection between the on-premises network and Direct Connect. Route the AWS traffic over the peering connection.

Key Takeaways

The question tests the difference between a Direct Connect public VIF and an S3 interface VPC endpoint, with the trap being that public VIF sounds internet-facing even though it runs over Direct Connect.

This scenario tests how an on-premises network with no internet access reaches Amazon S3 over AWS Direct Connect. The most cost-effective answer is A: a public virtual interface (VIF) carries the S3 traffic over the dedicated Direct Connect link.

Common mistake: Choosing C because interface endpoints sound more private; however, they add VPC, private VIF or Direct Connect gateway, endpoint hourly and data-processing costs, while a public VIF already meets the no-internet S3 access requirement.

Expert Analysis

The request path starts on-premises. The application sends an S3 API request from the on-premises network. Because the network has no direct internet access, that request must leave through the Direct Connect connection. The design question is therefore not how to give the on-premises network general internet access, but which Direct Connect attachment can carry S3 API traffic. A Direct Connect public virtual interface (VIF) provides exactly that path: it peers the on-premises router with AWS public services using public IP addresses over the dedicated Direct Connect link. The traffic does not traverse an internet provider, so it satisfies the no-internet constraint.

Why A is the cost-effective fit. Option A creates the public VIF and routes AWS traffic over it. S3 is an AWS public service, and a public VIF is designed for public AWS service endpoints such as S3. There is no VPC, no NAT gateway, no S3 interface endpoint, and no endpoint hourly or data-processing charge. The existing Direct Connect port and virtual interface carry the traffic. Some comments object that a public VIF sounds internet-facing, but a public VIF uses public IP addressing to reach AWS public services over Direct Connect; it does not require the on-premises network to have internet access. That distinction is the core trap.

Why the alternatives lose. Option B places a NAT gateway in a VPC and routes on-premises traffic to it; NAT gateways are for VPC resources needing outbound internet, not a correct on-premises-to-S3 path, and they add hourly and data-processing costs. Option C can work technically: an S3 interface endpoint gives private IP access from on-premises over Direct Connect when combined with a private VIF and Direct Connect gateway, and AWS documents this pattern. But it introduces VPC and endpoint components plus per-hour and per-GB endpoint charges, so it is not the most cost-effective when the only requirement is S3 access and a public VIF already removes internet dependency. Option D is invalid: VPC peering connects VPCs, not an on-premises network to Direct Connect. The correct choice is A.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a Direct Connect question asks for S3 access, first classify the target as an AWS public service rather than a VPC resource. If the requirement only forbids internet access and does not mandate private IPs, a public VIF is the lower-cost dedicated path; reserve interface endpoints, NAT gateways and VPC peering for scenarios that explicitly require private IP addressing or VPC-originated traffic. Read MOST cost-effectively as a signal to eliminate options with hourly endpoint or NAT charges.

Frequently Asked Questions

Does a Direct Connect public VIF require the on-premises network to have internet access?

No. A public VIF reaches AWS public services such as Amazon S3 over the Direct Connect link using public IP addresses; it bypasses internet service providers and does not require direct internet access on-premises.

Why is an S3 interface endpoint not the most cost-effective choice here?

An S3 interface endpoint can provide private IP access from on-premises over Direct Connect, but it adds VPC endpoint hourly and data-processing charges plus private VIF or Direct Connect gateway configuration. A public VIF already meets the no-internet S3 requirement at lower cost.

Can an on-premises application use an S3 interface endpoint over Direct Connect?

Yes, with the required private VIF, Direct Connect gateway and endpoint DNS configuration, on-premises clients can reach an S3 interface endpoint. That does not make it the cheapest option for this scenario.

More SAA-C03 FAQ →

Discussion 15 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 15

  1. Scheldon 👍 4 Answered C
    AnswerC Amazon S3 interface endpoint seems to be the best and only option as we are forced to use Private IP addressation. Interface endpoints for Amazon S3 Your network traffic remains on the AWS network. Use private IP addresses from your VPC to access Amazon S3 Require endpoint-specific Amazon S3 DNS names Allow access from on premises Allow access from a VPC in another AWS Region by using VPC peering or AWS Transit Gateway https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#types-of-vpc-endpoints-for-s3
  2. waldirlsantos 👍 4 Answered C
    B Need internet A,D doesn't conect to the s3 IMO, C is the solution for this question.
  3. LeonSauveterre 👍 3 Answered C
    A - Public VIFs route traffic over the public internet, but on-premises network has no direct internet access. B - NAT gateways provide internet access for resources within a VPC, but, again, on-premises network has no direct internet access. C - The traffic stays within AWS and the Direct Connect connection, ensuring security and compliance with the no-internet requirement. Also, this is cost-effective because it avoids the need for additional NAT gateways or public VIFs. D - Peering connections don't even support access to AWS public services like S3.
  4. elmyth 👍 3
    This article says "Use a private IP address over Direct Connect (with an interface VPC endpoint)" - C
  5. AMEJack 👍 2 Answered A
    Option A is the correct answer: 1) I need to connect to public services only, thus public VIF will be enough. 2) Interface endpoints is charged per hour, not cost effective.
Show 10 more comments
  1. EllenLiu 👍 2 Answered A
    public VIF allows on-premises networks to access AWS public services, like S3 it eliminates the need for internet access & interface endpoints while being cost-effective
  2. Kaula 👍 2 Answered C
    https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html
  3. TruthWS 👍 2
    Option C
  4. 0c21057 👍 1 Answered A
    AWS Direct Connect links your internal network to an AWS Direct Connect location over a standard Ethernet fiber-optic cable. One end of the cable is connected to your router, and the other to an AWS Direct Connect router. With this connection, you can create virtual interfaces directly to public AWS services (for example, to Amazon S3) or to Amazon VPC, bypassing internet service providers in your network path. An AWS Direct Connect location provides access to AWS in the Region with which it is associated. You can use a single connection in a public Region or AWS GovCloud (US) to access public AWS services in all other public Regions.
  5. Athena75 👍 1 Answered A
    A public virtual interface (public VIF) is a logical connection over AWS Direct Connect that gives your on-premises network direct access to public AWS services (such as Amazon S3 or DynamoDB) using public IP addresses, bypassing the public internet. https://docs.aws.amazon.com/directconnect/latest/UserGuide/WorkingWithVirtualInterfaces.html
  6. c7e80cd 👍 1 Answered A
    In short: C only works if the traffic originates inside a VPC, but your requirement is from on-premises outside AWS. That’s why A is the correct, cost-effective solution.
  7. Salilgen 👍 1 Answered A
    https://aws.amazon.com/blogs/networking-and-content-delivery/optimizing-amazon-s3-data-transfers-over-direct-connect/
  8. 0bdf3af 👍 1
    A. public VIF is the way you can connect on-premise with S3 via DirectConnect
  9. 0bdf3af 👍 1
    A. https://repost.aws/knowledge-center/s3-bucket-access-direct-connect
  10. EllenLiu 👍 1
    https://aws.amazon.com/privatelink/pricing/

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Scheduled scaling for a predictable morning EC2 traffic spike

S-grade

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide