Which action will fulfill these requirements and maintain security?

A company has application running on Amazon EC2 instances in a VPC. One of the applications needs to call an Amazon S3 API to store and read objects. The company’s security policies restrict any internet-bound traffic from the applications.

Which action will fulfill these requirements and maintain security?
A . Configure an S3 interface endpoint.
B . Configure an S3 gateway endpoint.
C . Create an S3 bucket in a private subnet.
D . Create an S3 bucket in the same Region as the EC2 instance.

View Answer

Answer: A

Explanation:

VPC endpoints

A VPC endpoint enables you to privately connect your VPC to supported AWS services and VPC endpoint services powered by AWS PrivateLink without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Instances in your VPC do not require public IP addresses to communicate with resources in the service. Traffic between your VPC and the other service does not leave the Amazon network.

An interface endpoint is an elastic network interface with a private IP address from the IP address range of your subnet that serves as an entry point for traffic destined to a supported service. Interface endpoints are powered by AWS PrivateLink, a technology that enables you to privately access services by using private IP addresses. AWS PrivateLink restricts all network traffic between your VPC and services to the Amazon network. You do not need an internet gateway, a NAT device, or a virtual private gateway.

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html