A SaaS company runs 200 EC2 instances in private subnets across three AZs fetching data from S3 and DynamoDB through a single NAT gateway. Data transfer charges spiked, with cross-AZ traffic and NAT processing fees dominating. Which network design lowers data transfer and NAT costs while preserving private connectivity?
Select an answer to reveal the explanation.
Short Explanation
You're getting hit with tolls because your S3 and DynamoDB traffic is detouring through that NAT gateway. Add gateway VPC endpoints so your data takes a private shortcut, and keep your traffic in the same AZ to dodge those cross-zone fees.
Full Explanation
Gateway VPC endpoints provide private, high-bandwidth connectivity to S3 and DynamoDB without traversing NAT gateways or the internet, eliminating NAT processing and data-processing charges for that traffic, while AZ-aware routing such as same-AZ endpoints, clients, and load balancing reduces inter-AZ transfer fees that accrue when traffic crosses AZ boundaries. Adding a NAT gateway per AZ improves availability but still sends service traffic through NAT, so processing charges remain and the dominant cost driver is unaddressed. Transit Gateway centralizes VPC interconnectivity but does not provide direct private access to S3 and DynamoDB in this pattern and still incurs attachment and data-processing costs without removing NAT for service traffic. Routing through an internet gateway with public addresses breaks the private-subnet requirement, exposes instances, and incurs internet data-transfer behavior rather than optimizing private Regional traffic. Exam caveat: choose gateway endpoints for S3 and DynamoDB and interface endpoints for most other AWS services. Practical check: review VPC Flow Logs and Cost Explorer by AZ and NAT gateway to confirm service traffic moved to endpoints.