A SysOps Administrator is configuring a new VPC environment where Amazon EC2 instances in a private subnet must regularly upload large datasets to an Amazon S3 bucket. To avoid NAT Gateway data processing charges, the administrator deploys a VPC gateway endpoint for Amazon S3. However, monitoring reveals that S3 traffic from the private subnet is still traversing the NAT Gateway, resulting in high data transfer costs. Which configuration change should the administrator make to resolve this issue?
- Associate the S3 gateway endpoint with the route table used by the private subnet.Cevap
- BAdd a route in the private subnet's route table for targeting the VPC's Internet Gateway.
- CAdd a route in the public subnet's route table targeting the S3 gateway endpoint.
- DModify the security group of the EC2 instances to allow outbound HTTPS traffic to the private IP addresses of the S3 gateway endpoint.
Cevap
Associate the S3 gateway endpoint with the route table used by the private subnet.
Associating the S3 gateway endpoint with the private subnet's route table is the correct solution. Gateway endpoints work by automatically adding a prefix list route pointing to the endpoint (e.g., `pl-xxxxxx` -> `vpce-xxxxxx`) in the selected route tables. If the private subnet's route table is not associated with the endpoint, traffic to Amazon S3 falls back to the next best route, which is the default route () pointing to the NAT Gateway.
Adım Adım Çözüm
Anahtar Kavram
VPC Gateway Endpoints require route table associations to dynamically inject prefix list routes, which direct traffic directly to the AWS service instead of using default routes like a NAT Gateway.
Tahmini Süre:1m 30s