Citizens download large zoning PDFs that currently hairpin through EC2 and a NAT Gateway before reaching users. Which delivery path is more cost-efficient for public downloads?
Select an answer to reveal the explanation.
Short Explanation
Don't route the town newsletter through the basement boiler room. Put public PDFs on S3 and CloudFront instead of NAT/EC2 hairpins.
Full Explanation
Citizens downloading large zoning PDFs should not hairpin through EC2 proxies and a NAT Gateway. That path burns EC2 hours and NAT data-processing charges for static public content. Serving the files from Amazon S3 with Amazon CloudFront is the cost-efficient public delivery pattern: S3 stores objects durably, CloudFront caches at the edge, and citizens retrieve PDFs without traversing private-subnet NAT or origin compute fleets. Versioned object keys and appropriate cache headers keep zoning updates predictable for planners and the public.
Forcing every PDF through a private NAT Gateway and a fleet of proxy EC2 instances on purpose maximizes the anti-pattern's cost. Emailing each PDF from an RDS database trigger avoids object storage poorly—relational engines and email are not CDN substitutes for large public files. Requiring Direct Connect from every citizen home before allowing a download is operationally impossible and economically nonsensical for public documents.
Exam caveat: sensitive non-public documents may need signed URLs, auth, or non-public buckets—cost efficiency does not mean making confidential files world-readable. Still, public zoning PDFs belong on S3+CloudFront, not NAT hairpins.
Operational check: migrate zoning PDFs to S3, attach a CloudFront distribution with HTTPS and sensible TTLs, decommission the EC2/NAT download path, compare NAT Bytes and EC2 cost for that workflow, and sample citizen download latency and HTTP cache hit ratios after cutover.