You have an application that is going to be hosted on an EC2 Instance. The application needs to access Kinesis Data streams. There is a security mandate that no data should leave the VPC onto the Internet. Which of the following would help you ensure the application adheres to the security requirement?

Answer options:

A.Enable VPC Enhanced Routing.
B.Make use of a NAT gateway.
C.Make use of a VPC Endpoint gateway.
D.Make use of a VPC Endpoint Interface.

Answer - D
The AWS Documentation mentions the following.
You can use an interface VPC endpoint to keep traffic between your Amazon VPC and Kinesis Data Streams from leaving the Amazon network. Interface VPC endpoints don`t require an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection.
Option A is incorrect because VPC Enhanced Routing is a feature for Amazon Redshift and does not help in this scenario.
Option B is incorrect because the traffic still traverses to the internet with a NAT gateway.
Option C is incorrect because a VPC Endpoint gateway is only used for S3 and DynamoDB.For more information on accessing Kinesis streams via a VPC, please refer to the below URL
https://docs.aws.amazon.com/streams/latest/dev/vpc.html