An application is deployed on EC2 instances inside a private VPC subnet. The application uses KMS CMK to encrypt and decrypt data. Regulatory requirements specify that all data must not traverse over the public internet. Which solution option satisfies these requirements most efficiently?

Answer options:

A.Access KMS via a VPC Interface Endpoint.
B.Access KMS via a VPC Gateway Endpoint.
C.Access KMS via a NAT Gateway.
D.Access KMS via an AWS Direct Connect.
E.Access KMS via a proxy server.

Answer: A
Option A is CORRECT because a VPC Interface Endpoint enables a private connection between VPC to KMS service without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection.
Option B is incorrect because VPC Gateway Endpoint supports Amazon S3 and Amazon DynamoDB services and not the KMS Service.
Option C is incorrect because a NAT gateway enables instances inside a private subnet to communicate to the public internet. It does not satisfy the regulatory requirement.
Option D is incorrect because AWS Direct Connect is used to connect a customer from on-premises to AWS services over a private dedicated network and does not fulfill the ask.
Option E is incorrect because the proxy server acts as a gateway between you and the internet. It`s an intermediary server separating end users from the websites they browse over the public network. Hence it does not satisfy the regulatory requirement.
Reference:
https://docs.aws.amazon.com/kms/latest/developerguide/kms-vpc-endpoint.html
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html