Instances in private subnets transfer terabytes to S3 through a NAT gateway, generating high hourly and data-processing charges. What is the most cost-effective fix that keeps the traffic off the internet?
A.Add a second NAT gateway in another AZ
More NAT gateways increase hourly cost and do not remove per-GB processing fees.
B.Create a gateway VPC endpoint for S3 and update the route table
Correct. A free gateway endpoint bypasses the NAT gateway entirely for S3 traffic.
C.Give each instance a public IP and use the internet gateway
Public IPs expose private instances and route through the IGW with its own data-transfer pricing — worse security and not cheaper.
D.Move the data to EFS
EFS is a different storage class with different pricing; it does not address the access-pattern problem.
Why this answer
A gateway VPC endpoint routes S3 traffic over the AWS network without a NAT gateway, eliminating NAT data-processing charges for S3 traffic. Gateway endpoints for S3 and DynamoDB carry no hourly endpoint charge.
Correct answer: B · Last reviewed 2026-10-25
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Cost-Optimized Databases & Networking practice session.
Practice Cost-Optimized Databases & Networking