Networking

Your EC2 instances in a private subnet need to reach S3 and a third-party API, but must never be reachable from the internet. Design the networking.

Outbound-only access comes from a NAT Gateway in a public subnet, but S3 traffic should skip it entirely through a VPC endpoint, which is free and never leaves the AWS network. Nothing can reach in because there's no route for it to take, not because a rule is blocking it, and that distinction is usually the real follow-up question.

You have a dozen VPCs that all need to reach each other and a shared-services VPC. Would you use VPC Peering or Transit Gateway, and why?

Peering connects two VPCs directly and doesn't scale past a handful of them, since connections grow quadratically and traffic can't transit through a peered VPC to reach a third. Transit Gateway is a central routing hub that turns the same problem into one connection per VPC, and it's the right call anywhere past three or four VPCs.

How would you securely connect an on-premises data center to a VPC, and when would you reach for Direct Connect instead of a Site-to-Site VPN?

A Site-to-Site VPN is fast to set up, encrypted by default, and runs over the public internet, which is also its ceiling: bandwidth and latency aren't guaranteed. Direct Connect is a dedicated physical link with predictable performance, but it takes weeks to provision and isn't encrypted on its own. Most serious hybrid setups end up running both.