EC2 instances in private subnets send large volumes of traffic to S3.
Reduce NAT processing charges and keep the path within the AWS network.
Which design is most appropriate?
Create an S3 Gateway VPC Endpoint and route private-subnet S3 traffic to it instead of through a NAT Gateway.
Detailed explanation
DNS resolution alone does not change the S3 data path or NAT processing.
DNS resolution alone does not change the S3 data path or NAT processing.
Redundancy may improve availability, but it does not reduce S3 NAT processing charges.
Redundancy may improve availability, but it does not reduce S3 NAT processing charges.
This increases exposure and conflicts with the private-path requirement.
This increases exposure and conflicts with the private-path requirement.
The endpoint separates S3 traffic from NAT processing and keeps access on the AWS network.
The endpoint separates S3 traffic from NAT processing and keeps access on the AWS network.
Check official documentation
Compare the following points with the official documentation.
Amazon S3 Gateway VPC endpoint routing and NAT Gateway pricingの公式説明を確認する。
What to confirm
Gateway EndpointとNAT Gatewayの経路・料金・公開範囲を比較できる。
Key points
- Gateway VPC Endpoint
- NAT Gateway
- AWS service path
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current behavior in the official SOA-C03 guide and AWS service documentation.
Foundation review
Route selection
A route-table entry determines whether S3 traffic uses the endpoint or NAT path.
Private access
A private endpoint path can reduce exposure and processing charges for supported services.