Examkin

Question

Difficulty: MediumCost-Effective Network Routing and Data Transfer Optimization

An enterprise runs a data processing application on Amazon EC2 instances located in private subnets. The application downloads and processes 10 TB10\text{ TB} of raw files daily from an Amazon S3 bucket located in the same AWS Region. Currently, all traffic to Amazon S3 is routed through a NAT Gateway, which has led to high monthly NAT Gateway data processing charges. A solutions architect must optimize the network architecture to minimize data transfer costs without compromising security. Which modification will achieve the highest cost savings?

  1. A
    Deploy an Interface VPC Endpoint (AWS PrivateLink) for Amazon S3 in each private subnet and update the application endpoint configuration.
  2. Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables of the private subnets.Answer
  3. C
    Set up an AWS Transit Gateway to route the S3 traffic to a centralized VPC containing a shared NAT Gateway.
  4. D
    Configure the EC2 instances with public IP addresses and route S3 traffic directly through an Internet Gateway.

Answer

Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables of the private subnets.
Creating a Gateway VPC Endpoint for Amazon S3 is the most cost-effective and secure solution. Gateway VPC Endpoints are offered at no cost, with no hourly charges or data processing fees. By associating the endpoint with the private subnet route tables, S3 traffic bypasses the NAT Gateway entirely, eliminating the high data processing fees while keeping the EC2 instances secure in their private subnets.

Step-by-Step Solution

1
Analyze the current data transfer route and costs.
The application transfers 10 TB10\text{ TB} of data daily from EC2 instances in private subnets to Amazon S3 via a NAT Gateway. NAT Gateways charge a data processing fee (approximately $0.045 per GB\$0.045\text{ per GB}) in addition to hourly charges, leading to high daily costs.
Understanding the source of the cost is necessary to evaluate alternative routing paths.
2
Evaluate private routing alternatives for Amazon S3.
Gateway VPC Endpoints for Amazon S3 are available at no additional cost (no hourly charges, no data processing fees). Interface VPC Endpoints (AWS PrivateLink) support Amazon S3 but incur an hourly charge and data processing fees (approximately $0.01 per GB\$0.01\text{ per GB}).
Identifying the pricing models of alternative VPC endpoints helps select the most cost-effective solution.
3
Select and configure the most cost-effective and secure solution.
Create a Gateway VPC Endpoint for S3 and associate it with the route tables of the private subnets. This routes the traffic to S3 directly through the AWS network backbone, bypassing the NAT Gateway entirely and securing the connection without exposing instances to the public internet.
This configuration provides the highest cost savings while maintaining the security posture of the private subnets.

Key Concept

Gateway VPC Endpoints provide a free, secure pathway for VPC resources to access Amazon S3 and DynamoDB without traversing a NAT Gateway or utilizing public IP addresses.
Estimated Time:1m 30s
Rate this question

Topics

Cost-Effective Network Routing and Data Transfer Optimization