1. A SaaS company runs a multi-tenant web application on Amazon EC2. They use a single large NAT gateway to allow instances in private subnets to download software updates from the internet. The company is experiencing unexpectedly high NAT gateway charges. A solutions architect reviews the architecture and discovers that a large portion of the traffic flows from EC2 instances to Amazon S3 and Amazon DynamoDB endpoints. What is the MOST cost-effective remediation?
- A. Replace the NAT gateway with a NAT instance using a t3.small to reduce hourly charges
- B. Enable VPC Flow Logs to identify and block unnecessary traffic at the NAT gateway
- C. Create S3 and DynamoDB VPC gateway endpoints and update the route tables so that traffic to these services bypasses the NAT gateway✓ Correct
- D. Move all EC2 instances to public subnets and assign Elastic IP addresses to eliminate the need for a NAT gateway
Explanation
VPC gateway endpoints for S3 and DynamoDB are free and route traffic through the AWS private network, completely bypassing the NAT gateway. Since NAT gateway charges include both hourly rates and per-GB data processing fees, removing S3 and DynamoDB traffic from the NAT gateway path directly reduces costs. A NAT instance on a t3.small reduces hourly costs but still incurs data processing charges for all traffic including S3/DynamoDB flows, and introduces management overhead without fully solving the problem. VPC Flow Logs are a monitoring tool; they identify traffic patterns but do not reduce data processing charges. Moving instances to public subnets is a significant security regression and violates best practices for multi-tenant production environments, making it an unacceptable cost-optimization approach.