Write to a cross-account S3 bucket privately using a gateway VPC endpoint

SCS-C02 By islever Editorial Last updated

Design and implement network security controls. Design and implement controls that provide confidentiality and integrity for data in transit.

Short answer

D A gateway VPC endpoint for S3 in Account A keeps the cross-account write on the AWS private network with minimal overhead.

Question

A company has two AWS accounts: Account A and Account B. Each account has a VPC. An application that runs in the VPC in Account A needs to write to an Amazon S3 bucket in Account B. The application in Account A already has permission to write to the S3 bucket in Account B. The application and the S3 bucket are in the same AWS Region. The company cannot send network traffic over the public internet. Which solution will meet these requirements?
  1. In both accounts, create a transit gateway and VPC attachments in a subnet in each Availability Zone. Update the VPC route tables.
  2. Deploy a software VPN appliance in Account A. Create a VPN connection between the software VPN appliance and a virtual private gateway in Account B.
  3. Create a VPC peering connection between the VPC in Account A and the VPC in Account B. Update the VPC route tables, network ACLs, and security groups to allow network traffic between the peered IP ranges
  4. In Account A, create a gateway VPC endpoint for Amazon S3. Update the VPC route table in Account A. Correct Answer

Key Takeaways

S3 gateway endpoints are free, scale automatically, and keep S3 traffic on the AWS backbone without a transit gateway, VPN, or peering relationship. Because the bucket already grants cross-account write permission, only the private route in Account A is needed; the traffic stays within AWS and never traverses the public internet.

An app in Account A's VPC must write to an S3 bucket in Account B in the same Region without using the public internet. The bucket policy already grants the app write permission. A gateway VPC endpoint for Amazon S3 in Account A routes S3 traffic over the AWS private network (no internet gateway or NAT needed), keeping the traffic off the public internet with the least operational overhead.

Common mistake: Choosing VPC peering or a transit gateway/VPN. Those also avoid the public internet but add cost and operational overhead for what is a single S3 write path; a gateway endpoint is the simpler, lower-latency, no-cost solution when only S3 access is required.

Expert Analysis

Why the Answer Is Correct

The requirement is simply private, internet-free access from Account A to an S3 bucket in Account B. A gateway VPC endpoint for Amazon S3 in Account A's VPC routes the PutObject traffic over the AWS network, satisfying "no public internet" with zero additional infrastructure. The existing bucket policy already authorizes the cross-account write, so no peering or VPN is needed.

Why the Other Options Are Wrong

A (transit gateway) and C (VPC peering) would also keep traffic private but introduce unnecessary cost and management overhead for a single S3 path; peering also would not by itself prevent internet routing without the endpoint. B is wrong because a software VPN tunnels over the public internet, directly violating the no-public-internet constraint.

Community Comment Notes

Community strongly favored D ("100000%%"), noting both C and D work but D has less overhead and better performance. A commenter added the caveat that gateway endpoints do not reach on-prem or other-Region peered VPCs—irrelevant here since the bucket is same-Region.

Official Reference

https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

This link opens the official vendor documentation in a new tab.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. Nash101 👍 2
    C A. Transit Gateway: While transit gateways can connect multiple VPCs, they are more complex to set up and manage compared to VPC peering for this specific scenario. They might be a better choice for intricate multi-account VPC connectivity needs. B. Software VPN: A software VPN creates a secure tunnel over the internet, which violates the requirement of avoiding public internet traffic. Additionally, VPNs can introduce performance overhead and management complexity. D. Gateway VPC Endpoint for S3: This option utilizes a Gateway VPC endpoint for S3 access within the VPC in Account A. However, it only allows access to S3 within the same account (Account A). The application needs access to the S3 bucket in a different account (Account B).
  2. VerRi 👍 2 Answered D
    Both C and D should work, but considering the scenario, it only requires writing to S3, and D has less operational overhead and better performance.
  3. grekh001 👍 1
    D. However, gateway endpoints do not allow access from on-premises networks, from peered VPCs in other AWS Regions, or through a transit gateway. For those scenarios, you must use an interface endpoint, which is available for an additional cost. https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html
  4. cumzle_com 👍 1 Answered D
    By using a gateway VPC endpoint, the solution remains within the AWS network, ensuring low latency and secure traffic flow without the need for additional infrastructure and complexity
  5. Certified101 👍 4 Answered D
    D 100000%%
Show 1 more comment
  1. adit 👍 1 Answered C
    Option C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Preserve EC2 forensic evidence by isolating first, then capturing memory before stopping the instance

S-grade

Grant the report Lambda Security Hub read-only access because findings are already in Security Hub

S-grade

Deny inbound MySQL 3306 and allow outbound TLS 443 with ephemeral return in a custom NACL

S-grade

Prepare a PHI/public-bucket audit with Macie, Audit Manager, and Security Hub FSBP

S-grade

← Back to SCS-C02 Study Guide