A county records office runs analytics jobs in private VPC subnets that read large case-file objects from Amazon S3 and meter metadata from Amazon DynamoDB. Staff want higher, more predictable throughput and to keep that traffic on the AWS network instead of hairpinning through the internet or a NAT gateway. Which design best meets those goals?
Select an answer to reveal the explanation.
Short Explanation
Think of a private on-ramp that never leaves AWS’s road system. Gateway VPC endpoints for S3 and DynamoDB let private-subnet jobs talk to those services without NAT or the public internet. You keep the data path on the AWS network—better for throughput predictability and a cleaner security story for municipal case files.
Full Explanation
Gateway VPC endpoints provide private connectivity from a VPC to Amazon S3 and Amazon DynamoDB without requiring an internet gateway, NAT device, or VPN. Traffic remains on the AWS network, which can improve performance characteristics for large object and table access and reduces exposure compared with hairpinning through NAT or the public internet. Internet gateways with public IPs, peering that still relies on public paths, and load balancers in front of public service endpoints do not deliver the same private AWS-network data path for these managed storage services.