DEA-C01 Practice Question 49: S3 Gateway VPC Endpoint

"With a gateway endpoint, you can access Amazon S3 from your VPC, without requiring an internet gateway or NAT device for your VPC, and with no additional cost." Creating the endpoint and associating it with the route tables adds a route that points S3-bound traffic at the endpoint, so it leaves the NAT gateway's data-processing path entirely and stays on the AWS network. The documentation is explicit on price: "There is no additional charge for using gateway endpoints." Both goals are met with one configuration change and no movement of workloads.

Option A achieves the private path but is the expensive way to do it. The same documentation notes that an interface endpoint "is available for an additional cost", per endpoint-hour and per GB processed, whereas the gateway endpoint is free. Interface endpoints earn their cost when access is needed from on-premises networks, peered VPCs in other Regions, or through a transit gateway, none of which applies here.

Option B changes authorization, not routing. A bucket policy can reject requests, but the packets would still be sent out through the NAT gateway to reach S3's public endpoint, so neither the cost nor the network-path requirement is addressed. (The docs also warn that aws:SourceIp does not behave as expected for requests traversing a VPC endpoint; aws:VpcSourceIp is the correct key.)

Option D removes the NAT charge by putting the compute on the public internet, the opposite of what security asked for, and it exposes cluster and job nodes that have no business having public addresses.

Reference: Gateway endpoints for Amazon S3