A company's private-subnet EC2 instances fetch large objects from S3 through a NAT gateway, and the associated data-processing charges show up prominently on every bill. What is the most effective fix to eliminate those charges?
Show answer and explanation
Answer: C
An S3 Gateway endpoint is free to use and routes S3 traffic across the AWS network within the VPC, bypassing the NAT gateway entirely — which removes the NAT data-processing charges that apply per GB. It also removes the need for instances even to have internet egress paths for S3 access.
Why the other options are wrong
- A. Transfer Acceleration is for speeding uploads over long internet distances and it adds its own per-GB surcharge; it does nothing about traffic leaving a private subnet.
- B. It is true that same-region EC2-to-S3 traffic has no data-transfer fee, but the statement does not re-route anything: instances reaching S3 through a NAT gateway keep paying NAT processing charges regardless.
- D. S3 is a regional service and cannot be addressed per Availability Zone; One Zone-IA only changes the durability of the stored objects, not the networking path or its charges.
Exam tip. Same-region EC2-to-S3 traffic is free of transfer fees; a Gateway endpoint additionally removes NAT gateway data-processing charges.