NAT gateway costs, gateway endpoints and data transfer charges

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

1. Batch jobs in private subnets read tens of terabytes a month from Amazon S3 in the same Region, and the bill is dominated by NAT gateway data processing. The team wants that charge removed. A colleague proposes an interface endpoint for Amazon S3, noting that Amazon S3 supports one. Which solution meets these requirements?

   Right. In the game that’s Renown for your Design Cost-Optimized Architectures building.

   Not that one: D is right. In the game your Design Cost-Optimized Architectures building would lose a little Renown, and this question would come back later.

   Your answerA.Add a second NAT gateway so that the processed traffic is spread across two gateways.Data processing is charged per GB; two gateways process the same volume.Your answerB.Create an S3 interface endpoint in each Availability Zone as the colleague proposes.An interface endpoint reaches Amazon S3 privately but is "available for an additional cost", per endpoint hour and per GB.Your answerC.Move the instances to public subnets with public IPs so they bypass the NAT gateway.Exposes the instances to the internet to save a data processing charge.The answerD.Create a gateway endpoint for Amazon S3 and add it to the route tables of the private subnets.In-Region access from inside the VPC is exactly the gateway endpoint's case, and it is free. "With a gateway endpoint, you can access Amazon S3 from your VPC, without requiring an internet gateway or NAT device for your VPC, and with no additional cost", and "there is no additional charge for using gateway endpoints." The colleague is right that both types exist - "Amazon S3 supports both gateway endpoints and interface endpoints" - which is why the interface answer survives a first reading. The difference is what each is for: an interface endpoint is what you need when the traffic comes from somewhere a gateway endpoint cannot serve, and it is billed.

   Written from docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

2. A VPC has private subnets in three Availability Zones, all routed to a single NAT gateway in one Availability Zone. A solutions architect is asked to reduce the blast radius of an Availability Zone failure for outbound traffic, and the company will accept a higher hourly charge to do it. Which approach will meet these requirements?

   Right. In the game that’s Renown for your Design Cost-Optimized Architectures building.

   Not that one: B is right. In the game your Design Cost-Optimized Architectures building would lose a little Renown, and this question would come back later.

   Your answerA.Add a second route to 0.0.0.0/0 in each private subnet's route table so that traffic fails over between gateways.A route table cannot hold two routes to 0.0.0.0/0, and route tables do not fail over between targets. Re-pointing a route is a manual change.The answerB.Put a NAT gateway in each Availability Zone and route each private subnet to its zone's gateway.A NAT gateway is a zonal resource, so resilience comes from placement rather than from redundancy inside one zone. AWS states the recommendation in the use-case page.Your answerC.Create a second NAT gateway in the same Availability Zone and alternate the private subnets between the two gateways.Two gateways in one Availability Zone fail together. The requirement is about surviving the loss of that zone, which more capacity inside it cannot address.Your answerD.Replace the NAT gateway with a NAT instance in an Auto Scaling group that spans all three of the Availability Zones in the VPC.Trades a managed, zone-redundant-by-deployment service for one the customer must patch and scale, and an Auto Scaling group still places each instance in one zone at a time.

   Show the full explanation and doc quotes

   "if the instances in the private subnet in Availability Zone A also need to reach the internet, you can create a route from this subnet to the NAT gateway in Availability Zone B. Alternatively, you can improve resiliency by creating a NAT gateway in each Availability Zone that contains resources that require internet access." The single shared gateway is the first arrangement: it works, and it makes every zone's egress depend on one zone. Per-zone gateways remove that dependency, and the stem has already accepted the extra hourly cost.

   Written from docs.aws.amazon.com/vpc/latest/userguide/nat-gateway-scenarios.html

3. A company's 12 spoke VPCs reach the internet through NAT gateways in a central egress VPC over a transit gateway. Instances in the spokes move about 200 TB a month to and from Amazon S3 and Amazon DynamoDB in the same Region, all along that path. The company must remove the NAT gateway and transit gateway processing charges on this traffic without adding any hourly charges. Which combination of steps should a solutions architect take to meet these requirements? (Select TWO.)

   Right. In the game that’s Renown for your Design Cost-Optimized Architectures building.

   Not that one: D,E is right. In the game your Design Cost-Optimized Architectures building would lose a little Renown, and this question would come back later.

   Your answerA.Create a gateway endpoint for Amazon S3 once in the egress VPC and associate it with the route tables of the egress VPC's transit gateway subnets.Gateway endpoints do not allow access through a transit gateway, so the spokes' S3 traffic would keep using the NAT gateways.Your answerB.Create interface endpoints for Amazon S3 and DynamoDB in a shared services VPC, and have the spoke VPCs reach them over the transit gateway.Interface endpoints have an hourly fee and a per-GB charge, and the transit gateway would still process every byte.Your answerC.Replace the central NAT gateways with a NAT gateway in each spoke VPC, routed from the spoke's private subnet route tables, so the traffic avoids the transit gateway.Removes the transit gateway charge but keeps NAT gateway processing on 200 TB and adds hourly charges for 12 new NAT gateways.Your answerD.Create a gateway endpoint for Amazon S3 in each spoke VPC and associate it with the spoke's private subnet route tables.Your answerE.Create a gateway endpoint for DynamoDB in each spoke VPC and associate it with the spoke's private subnet route tables.

   Show the full explanation and doc quotes

   "With a gateway endpoint, you can access Amazon S3 from your VPC, without requiring an internet gateway or NAT device for your VPC, and with no additional cost. However, gateway endpoints do not allow access from on-premises networks, from peered VPCs in other AWS Regions, or through a transit gateway." That last clause is what beats A. The DynamoDB page gives the same terms for E. With only D, the DynamoDB traffic keeps paying; with only E, the S3 traffic does.

   Written from docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html