A public-health department runs workloads in private subnets that must reach Amazon S3 and Amazon DynamoDB APIs without sending that traffic across the public internet or a NAT Gateway. Which design satisfies this requirement?
Select an answer to reveal the explanation.
Short Explanation
Private subnets still need groceries from S3 and DynamoDB—they just should not walk them through downtown (the internet). Gateway VPC endpoints put those AWS APIs on a private neighborhood path. NAT to the public endpoints works for many apps, but it is not what you want when the requirement is no public traversal for those APIs.
Full Explanation
Gateway VPC endpoints for Amazon S3 and Amazon DynamoDB keep AWS API traffic on the Amazon network using prefix-list routes in VPC route tables, avoiding internet gateways and NAT for those destinations. That pattern fits private-subnet public-health workloads that must not traverse the public internet for object and NoSQL API calls. Attaching internet gateways to private subnets or relying only on NAT contradicts the private-access goal; endpoints are the in-scope private integration mechanism for these gateway-supported services.