Instances in private subnets must call the Amazon SNS API, and security policy forbids routing that traffic through an internet gateway or NAT gateway. What provides private connectivity to the AWS service?
A.An interface VPC endpoint (AWS PrivateLink) for SNS
Correct. PrivateLink interface endpoints reach AWS APIs privately from inside the VPC.
B.A public subnet with a bastion host
A bastion in a public subnet does not make the private instances' API calls private.
C.A site-to-site VPN to another VPC
A VPN to another VPC does not provide private access to the SNS service endpoint.
D.Amazon Macie private discovery
Macie discovers sensitive data in S3; it is unrelated to connectivity.
Why this answer
Interface VPC endpoints (powered by AWS PrivateLink) create ENIs in your subnets that reach AWS service APIs privately, keeping traffic off the public internet. Most AWS services — including SNS — support interface endpoints.
Correct answer: A · Last reviewed 2026-10-25
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Security practice session.
Practice Network Security