A SysOps administrator configures a new gateway VPC endpoint for Amazon S3 to enable private access for Amazon EC2 instances in a private subnet. After deploying the endpoint, the administrator notices that the EC2 instances are still routing their traffic to Amazon S3 through an existing NAT gateway. Which of the following is the most likely cause of this behavior?
- The route table associated with the private subnet was not selected during the gateway endpoint creation.Answer
- BA route targeting the Internet Gateway (IGW) was not added to the private subnet's route table.
- CThe Network Access Control List (NACL) for the private subnet does not allow outbound traffic on ephemeral ports.
- DThe gateway VPC endpoint must be configured to route traffic through the NAT gateway to reach S3.
Answer
The route table associated with the private subnet was not selected during the gateway endpoint creation.
A gateway VPC endpoint works by automatically adding a route to the associated route tables that directs traffic destined for Amazon S3 (using its prefix list) to the endpoint. If the administrator does not select the private subnet's route table during creation, the route table will not contain the prefix list entry, and traffic to S3 will continue to match the default route (0.0.0.0/0) pointing to the NAT gateway.
Step-by-Step Solution
Key Concept
Gateway VPC endpoints require explicit route table association to add prefix list routing.