Private-subnet EC2 instances move several TB/day to S3 through NAT gateways, generating large data-processing charges. Which change removes most of this cost with no application changes?
A.Move the instances to public subnets
Public subnets are a security regression — never the answer.
B.Add a gateway VPC endpoint for S3 and route traffic through it
Correct. Free gateway endpoint, zero NAT processing on S3 traffic.
C.Use S3 Transfer Acceleration
Transfer Acceleration adds cost; it optimizes WAN uploads.
D.Replace S3 with EFS
EFS is a different storage model — not a drop-in S3 replacement.
Why this answer
Gateway endpoints for S3 (and DynamoDB) are free and keep traffic on the AWS network — the classic fix for NAT data-processing charges on S3-heavy workloads. Interface endpoints would also bypass NAT but carry per-GB costs; gateway endpoints are the cost-optimized answer for S3.
Correct answer: B · Last reviewed 2026-11-02
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Architecture Optimization practice session.
Practice Architecture Optimization