A SaaS company has 25 spoke VPCs in one Region reading large datasets from Amazon S3 through NAT gateways and Transit Gateway, driving high processing charges. It must preserve private connectivity while cutting data transfer costs. Which network control creates the most cost-effective path for this S3 access?
Select an answer to reveal the explanation.
Short Explanation
You're paying pricey detours when your S3 traffic goes through NAT gateways. You'll save by adding gateway endpoints in each spoke VPC, like slipping through a free private shortcut that never hits the public road.
Full Explanation
S3 gateway VPC endpoints provide private, highly available routing to S3 from within each VPC at no additional hourly or processing charge, eliminating Transit Gateway data processing fees and NAT gateway processing and data charges for same-Region S3 traffic. Routing through Transit Gateway plus centralized NAT incurs Transit Gateway per-gigabyte processing plus NAT processing and Internet-bound transfer costs while adding hairpin latency. Routing via per-VPC NAT gateways to public S3 endpoints still pays NAT hourly plus processing per gigabyte and exposes traffic to public endpoints. PrivateLink interface endpoints for S3 charge hourly per AZ plus per-gigabyte processing, which is useful for on-premises or cross-Region patterns but more expensive than free gateway endpoints for same-Region VPC access. Exam caveat: default to gateway endpoints for S3 and DynamoDB same-Region access when cost optimization is stated. Practical check: update spoke route tables to the gateway endpoint and remove NAT routes for S3 prefixes.