A company has a set of Instances hosting an application. These Instances are located in a private subnet in a VPC. The application now needs to make use of the KMS service. How can you achieve this in the MOST secure way possible?

Answer options:

A.Attach an Internet gateway to the VPC and convert the subnet to a public subnet.
B.Create a VPC Endpoint gateway and make the application use the VPC gateway.
C.Create a VPC Endpoint Interface and make the application use the VPC Endpoint.
D.Attach a NAT gateway to the VPC and convert the subnet to a public subnet.

Answer – C
The AWS Documentation mentions the following.
You can connect directly to AWS KMS through a private endpoint in your VPC instead of connecting over the internet. When you use a VPC endpoint, communication between your VPC and AWS KMS is conducted entirely within the AWS network.
AWS KMS supports Amazon Virtual Private Cloud (Amazon VPC) interface endpoints powered by AWS PrivateLink. Each VPC endpoint is represented by one or more Elastic Network Interfaces (ENIs) with private IP addresses in your VPC subnets.
Options A and D are incorrect since we should not route traffic via the Internet in this situation.
Option B is incorrect since the gateway is only used for the DynamoDB and S3 services.
For more information on KMS VPC Endpoints, please visit the below URL
https://docs.aws.amazon.com/kms/latest/developerguide/kms-vpc-endpoint.html