You have an application running in an EC2 instance and the instance is placed in a private subnet within a VPC. The application collects data from clients, generates messages, and then pushes the messages to an SQS queue in the same AWS region.
For security concerns, the messages should be delivered to the Amazon SQS queue over a secure, private network without being exposed to the internet.
How would you achieve this requirement?

Answer options:

A.Create the SQS queue in the private subnet of the VPC. When the EC2 instance sends messages to the SQS queue, the traffic is within the private subnet.
B.Configure a record set in Route 53 with the SQS queue name as its Alias target. The application delivers messages to the recordset through the private network.
C.Configure a NAT gateway in the private subnet and use the NAT gateway to forward messages to the SQS queue for the application.
D.In the VPC private subnet, create an Amazon VPC Endpoint for the Amazon SQS service. Enable the private DNS name for this endpoint.

Answer : D
Option A is incorrect because the SQS queue is independent of subnets. Hence it cannot be created in a private subnet.
Option B is incorrect because the record set in Route 53 cannot guarantee that the traffic goes through a private connection.
Option C is incorrect because a NAT gateway cannot be put in a private subnet. Moreover, the traffic that goes through a NAT gateway is still public instead of private.
Option D is CORRECT because you can configure the VPC Endpoint for the SQS service. VPC endpoints also provide reliable connectivity to Amazon SQS without requiring an internet gateway, Network Address Translation (NAT) instance, VPN connection, or AWS Direct Connect connection. With VPC endpoints, the data between your Amazon VPC and Amazon SQS queue is transferred within the Amazon network, helping protect your instances from internet traffic.
References:
https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-sending-messages-from-vpc.html.
https://aws.amazon.com/about-aws/whats-new/2018/12/amazon-sqs-vpc-endpoints-aws-privatelink/