Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 208 discussion

No, it’s not

Go to console and test it yourself! With Interface Endpoint you can add security groups.

There are two types VPC Endpoint: Gateway endpoint Interface endpoint A Gateway endpoint: 1) Helps you to securely connect to Amazon S3 and DynamoDB 2) Endpoint serves as a target in your route table for traffic 3) Provide access to endpoint (endpoint, identity and resource policies) An Interface endpoint: 1) Help you to securely connect to AWS services EXCEPT FOR Amazon S3 and DynamoDB 2) Powered by PrivateLink (keeps network traffic within AWS network) 3) Needs a elastic network interface (ENI) (entry point for traffic)

An interface VPC endpoint does provide a direct connection between the EC2 instance and the S3 bucket. It enables private communication between instances in your VPC and resources in other services without requiring an internet gateway, a NAT device, or a VPN connection. Option A , which recommends creating an interface VPC endpoint for Amazon S3 in the subnet where the EC2 instance is located and attaching a resource policy to the S3 bucket to only allow the EC2 instance's IAM role for access, is the correct solution for the given scenario. It meets the requirement to ensure that no API calls and no data are routed through public internet routes and that only the EC2 instance can have access to upload data to the S3 bucket.