Short answer: when an SAA-C03 question puts EC2 in private subnets, talks to S3 or DynamoDB in the same Region and asks for the most cost-effective fix, the answer is almost always a gateway VPC endpoint. This post shows the real-world case behind that pattern, an original practice question, and how to read it.
The real case behind the question
This is one of the most common surprises on AWS bills. A team moves batch jobs to EC2 instances in private subnets, as recommended. The instances need the internet for OS updates, so each Availability Zone gets a NAT Gateway. The jobs read and write a lot of data in S3.
A month later, EC2-Other is one of the biggest lines on the bill. Grouped by usage type, almost all of it is NatGateway-Bytes: every GB going to S3 was processed, and charged, by the NAT Gateway.
Example: 10 TB per month of S3 traffic through a NAT Gateway in us-east-1 (10,240 GB × US$ 0.045 per GB processed), on top of the hourly charge. A gateway endpoint carries the same traffic at no charge.
The fix takes minutes: create a gateway endpoint for S3 and add it to the private route tables. The S3 traffic leaves the NAT, and the NAT stays only for what really needs the internet. The full troubleshooting walkthrough is here.
Why the exam loves this case
It tests two domains at once: Design Cost-Optimized Architectures (20% of the exam), because the endpoint removes a charge, and Design Secure Architectures (30%), because traffic to S3 stays on the AWS network and can be restricted with endpoint and bucket policies.
Practice question
This question is original, written for practice. It is not taken from the real exam.
A company runs a fleet of Amazon EC2 instances in private subnets across two Availability Zones. The instances process files stored in an Amazon S3 bucket in the same AWS Region and write the results back to the bucket. A NAT gateway in each Availability Zone provides internet access for operating system updates. The monthly bill shows high NAT gateway data processing charges, and most of the traffic goes to Amazon S3.
Which solution will reduce these costs with the LEAST operational overhead?
Show the answer
Answer: B. A gateway endpoint for S3 has no hourly or data processing charge, it is managed by AWS, and it only needs a route table association. S3 traffic stops going through the NAT gateways.
How to read it: the keywords
| Phrase in the question | What it points to |
|---|---|
| “private subnets” + “S3 in the same Region” | A VPC endpoint for S3 |
| “reduce costs” or “most cost-effective” | Gateway endpoint (free) instead of interface endpoint (paid) |
| “LEAST operational overhead” | A managed feature, not something you run yourself (NAT instances) |
| “most of the traffic goes to S3” | The NAT is processing traffic that does not need the internet |
Why the other answers are wrong
- A. NAT instances: may lower the hourly cost, but you now patch, scale and make them highly available yourself. That is more overhead, and the S3 traffic still goes through them.
- C. Interface endpoint: it works, but it charges per hour per AZ and per GB. When a free gateway endpoint solves the same problem, it is not the most cost-effective choice.
- D. Transfer Acceleration: speeds up long-distance uploads over the internet through edge locations. It solves a different problem and adds cost.
Variations the exam likes
| If the question says… | Then think… |
|---|---|
| Applications on premises must reach S3 privately over Direct Connect or VPN | Interface endpoint: gateway endpoints cannot be used from on premises |
| Traffic comes from a peered VPC or through a Transit Gateway | Interface endpoint, for the same reason |
| Same scenario, but the service is DynamoDB | Gateway endpoint: DynamoDB also has one |
| The bucket must accept requests only from this VPC | Bucket policy with the aws:SourceVpce condition |
| The instances must reach another AWS service (for example ECR or Secrets Manager) without internet | Interface endpoint for that service |
Gateway endpoints only work for S3 and DynamoDB, only in the same Region, and only from inside the VPC. Many wrong answers are built on forgetting one of these three limits.
Exam technique you can reuse
- Read the last sentence first. It tells you the constraint: cost, operational overhead, availability or performance.
- Underline the facts that narrow the answer: private subnet, same Region, on premises, which service.
- Eliminate answers that solve a different problem, even if they are valid AWS features.
- If two answers both work, choose the one that best fits the constraint. Here, both B and C remove the NAT traffic, but only B is free.
Studying for the exam? The AWS Certifications hub collects every exam tip, and each one comes from a situation you will also see at work.