Instances hosted in the private subnet of your VPC need to access some important documents from the S3 bucket which is outside the VPC. Due to the confidential nature of these documents, you have to ensure that the traffic does not traverse through the internet. As an architect, how would you implement this solution?

Answer options:

A.Consider using a VPC Endpoint.
B.Consider using an EC2 Endpoint.
C.Move the instances to a public subnet.
D.Create a VPN connection and access the S3 resources from the EC2 Instance.

Correct Answer – A
AWS documentation mentions the following:
A VPC endpoint enables you to privately connect your VPC to supported AWS services and VPC endpoint services powered by PrivateLink without requiring an internet gateway, NAT device, VPN connection or AWS Direct Connect connection. Instances in your VPC do not require public IP addresses to communicate with resources in the service. Traffic between your VPC and the other services does not leave the Amazon network.
For more information on VPC Endpoints, please visit the following URL:
https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-endpoints.html