Instances in a private subnet can reach the internet via a NAT gateway, but the ops team wants to eliminate the NAT gateway's data-processing charges for traffic to S3 and DynamoDB. What's the fix?
A.Add more NAT gateways for redundancy
More NAT gateways increase cost, not reduce it.
B.Create gateway VPC endpoints for S3 and DynamoDB
Correct. Gateway endpoints bypass NAT for S3/DynamoDB at no charge.
C.Move the instances to a public subnet
Public subnets don't remove data-transfer cost and reduce security.
D.Assign Elastic IPs to the instances
Public IPs route through the IGW with its own egress pricing.
Why this answer
Gateway VPC endpoints route S3/DynamoDB traffic over the AWS network without a NAT gateway — free of hourly endpoint charge and eliminating per-GB NAT processing fees for that traffic. Classic cost question.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Networking Operations practice session.
Practice Networking Operations