SAA-C03 Q270 · Networking

Question

A company wants to deploy an AWS Lambda function that will read and write objects to Amazon S3 bucket. The Lambda function must be connected to the company's VPC. The company must deploy the Lambda function only to private subnets in the VPC. The Lambda function must not be allowed to access the internet. Which solutions will meet these requirements? (Select TWO)

Accepted Answer

The question has three critical requirements:

1. **Lambda in private subnets** — Lambda is VPC-connected
2. **Must NOT access the internet** — No NAT gateway, no internet gateway path
3. **Must read/write to S3** — Needs a path to S3 that doesn't traverse the internet

**Option C — Gateway VPC Endpoint for S3:**
- A Gateway VPC Endpoint provides a private route to S3 entirely within the AWS network
- It works by adding a route in the subnet's route table pointing S3 traffic to the endpoint
- No internet access required — traffic stays within AWS
- **Free** — no hourly or data processing charges
- This is the most common and recommended approach

**Option D — Interface VPC Endpoint for S3:**
- An Interface VPC Endpoint (powered by AWS PrivateLink) creates an ENI in your subnet with a priva

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips