A parks department application in a private subnet must call Amazon S3 without sending traffic across the public internet. Which design combines private connectivity with secure access controls?
Select an answer to reveal the explanation.
Short Explanation
Private apps talking to S3 should use the building’s private hallway, not the street. A VPC gateway endpoint for S3 keeps traffic on the AWS network, and IAM plus bucket policies lock who may use that path. Public IPs, SSH tunnels, or anonymous puts are the opposite of private, least-privilege access.
Full Explanation
VPC gateway endpoints for Amazon S3 allow instances in private subnets to reach S3 without a NAT gateway or internet gateway hop for that traffic. Pairing the endpoint with IAM policies and S3 bucket policies—often conditioning on the VPC endpoint—implements least-privilege resource access alongside private connectivity. Public IPs on app servers, SSH-based object transfer, and anonymous writes expand exposure and do not meet the parks department’s private-access requirement.