AWS Interview DropAdvanced TierScenario+50 XP on read
Your EC2 instances in a private subnet need to reach S3 and a third-party API, but must never be reachable from the internet. Design the networking.
#VPC#Networking#Security#NAT
Core Summary
Outbound-only internet access comes from a NAT Gateway in a public subnet, but AWS-service traffic should bypass it entirely via VPC endpoints — which is both cheaper and more secure. The asymmetry between security groups and NACLs is what makes "private" actually hold.
Hints
Hint 1: A NAT Gateway lives in the public subnet, not the private one
Hint 2: S3 traffic should never leave the AWS network
Hint 3: Security groups are stateful; NACLs are not
Reported in interviews at Amazon, Cloudflare