Compliance requires that EC2 instances reach AWS service APIs such as S3 and Systems Manager without any traffic leaving the AWS network for the public internet. Which setup accomplishes this?
Show answer and explanation
Answer: D
VPC endpoints let resources in a VPC reach supported AWS services privately. Interface endpoints use AWS PrivateLink and place elastic network interfaces in the subnets, while gateway endpoints for S3 and DynamoDB add routes to the route table. Either way, the traffic stays on the AWS network. A dedicated link to a data center or a NAT gateway still uses external paths, and peering connects VPCs rather than AWS service APIs.
Why the other options are wrong
- A. A dedicated link connects an on-premises facility to AWS. It does nothing for instances in a VPC calling AWS service APIs.
- B. VPC peering connects one VPC to another. It does not provide a private route to AWS service endpoints.
- C. A NAT gateway forwards requests out through an internet gateway, so the traffic still reaches public AWS endpoints over the internet path.