A data pipeline in private subnets reads about 40 TB per month from an S3 bucket in the same Region. The monthly bill shows large per-GB charges for NAT gateway processing. Which change removes most of this cost without changing the pipeline code?
Show answer and explanation
Answer: C
Instances in private subnets reach S3 through a NAT gateway, which charges a processing fee for every gigabyte it forwards. A gateway VPC endpoint for S3 adds a route-table entry so that traffic reaches S3 over the AWS network without passing through the NAT gateway, and the gateway endpoint itself has no hourly or data charge. The code and bucket stay the same. Transfer Acceleration, public subnets or cross-Region replication do not remove the NAT processing fee.
Why the other options are wrong
- A. Transfer Acceleration routes transfers through CloudFront edge locations to speed up long-distance uploads, and it adds its own per-GB fee for same-Region traffic.
- B. Public subnets with an internet gateway would avoid NAT fees, but they expose the workers to the internet and abandon the private design. A gateway endpoint keeps the private path without that exposure.
- D. Cross-Region replication adds storage and replication charges and does not change how the workers reach S3, so the NAT processing fee on every read continues.