Your company has an application that has been developed and needs to be hosted on an EC2 Instance. The EC2 Instance is located in a private subnet and needs to access AWS Kinesis streams without passing into the Internet. How can you achieve this in the best manner possible?

Answer options:

A.Attach a NAT gateway to the VPC
B.Attach an Internet gateway to the VPC
C.Create a VPC Gateway Endpoint that would allow access to Kinesis Streams
D.Create a VPC Interface Endpoint that would allow access to Kinesis Streams

Answer – D
The AWS Documentation mentions the following.
You can use an interface VPC endpoint to keep traffic between your Amazon VPC and Kinesis Data Streams from leaving the Amazon network. Interface VPC endpoints don`t require an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Interface VPC endpoints are powered by AWS PrivateLink, an AWS technology that enables private communication between AWS services using an elastic network interface with private IPs in your Amazon VPC.Options A and B are incorrect since it is mentioned in the question that traffic should not go via the Internet.
Option C is incorrect since this is mostly used for S3 and DynamoDB access from Instances in the private subnet.
For more information on VPC Endpoints Interfaces, please refer to the below URL-
https://docs.aws.amazon.com/streams/latest/dev/vpc.html