A company is planning on hosting an application that will make use of Kinesis Streams. The consumer-based application will be sitting on an EC2 Instance in a private subnet. There is requirement to ensure that the application can connect to the Kinesis stream without passing through the Internet. Which of the following would be ideal for this scenario?

Answer options:

A.Create a VPN connection and attach it to the VPC
B.Create a NAT Instance in the public subnet
C.Create a NAT Gateway in the public subnet
D.Use a VPC endpoint

Answer – D
The AWS Documentation mentions the following
You can use an interface VPC endpoint to keep traffic between your Amazon VPC and Kinesis Data Streams from leaving the Amazon network. Interface VPC endpoints don`t require an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Interface VPC endpoints are powered by AWS PrivateLink, an AWS technology that enables private communication between AWS services using an elastic network interface with private IPs in your Amazon VPC
All other options are incorrect since this would mean that the traffic needs to traverse via the Internet
For more information on using streams with VPC endpoints, please refer to the below URL
https://docs.aws.amazon.com/streams/latest/dev/vpc.html