Exams / SCS-C03 / Study guide / Private access to services (VPC endpoints, endpoint policies, PrivateLink, Client VPN)

Private access to services (VPC endpoints, endpoint policies, PrivateLink, Client VPN): SCS-C03 study notes and practice questions

What to know about Private access to services (VPC endpoints, endpoint policies, PrivateLink, Client VPN) for the SCS-C03 exam, from the Data Protection domain (18% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.

Last verified November 2026 against current AWS documentation ·How we write our questions

What to know for the exam

These questions ask how to keep traffic off the public internet and how to limit which data can move along that path. The answer is usually a network route paired with a policy that makes the route safe.

Endpoint types

Gateway endpoints exist only for Amazon S3 and DynamoDB. They add a route to the route table, have no hourly charge, and accept an endpoint policy. They are used from inside the VPC, not from on-premises networks over VPN or Direct Connect.
Interface endpoints (AWS PrivateLink) place elastic network interfaces with private IP addresses in your subnets. They use security groups, support private DNS names, and can be reached from on-premises networks. They have hourly and per-GB charges.
Endpoint policies limit which principals, actions and resources can use an endpoint. A policy on an S3 gateway endpoint can allow only buckets in your organization, which stops copying data from the VPC to a personal bucket.
Resource-side conditions confirm where a request came from. aws:SourceVpce names one endpoint and aws:SourceVpc names one VPC. A bucket policy with either condition blocks requests that bypass the endpoint.
Your own services are published to other accounts through PrivateLink. You put a Network Load Balancer or Gateway Load Balancer in front of the service, and consumers create interface endpoints to it.
AWS Client VPN gives people a managed VPN into a VPC. It places users on the network. It is not the same as Verified Access, which checks each request to an application.

How to choose

Scenario wording	Pick
S3 or DynamoDB traffic from a VPC must avoid the internet, at no extra charge	Gateway endpoint
On-premises systems must reach an AWS service privately	Interface endpoint, reached over VPN or Direct Connect
Stop copies from the VPC to buckets outside the organization	Endpoint policy with `aws:ResourceOrgID`
A bucket must be reachable only through one endpoint	Bucket policy condition `aws:SourceVpce`
Expose an internal service to other accounts privately	PrivateLink endpoint service
Employees need a VPN into private subnets	Client VPN

Common traps

A gateway endpoint for every service. Only S3 and DynamoDB use gateway endpoints. Other services need interface endpoints.
An endpoint policy as the only control. An endpoint policy limits traffic through the endpoint. Requests that never use the endpoint are not affected, so the bucket policy also needs a condition.
Forgetting private DNS. Without it, the normal service name still resolves to public addresses and traffic does not use the endpoint.
A missing security group on an interface endpoint, which makes connections time out.
Confusing Client VPN with Verified Access. Client VPN extends the network to users. Verified Access grants per-request access to applications without a VPN.

Question 1

Medium · choose 2 ·Link to this question

A logistics firm runs its warehouse data pipeline on EC2 instances in private subnets, with no internet gateway or NAT gateway. The instances reach Amazon S3 through a gateway VPC endpoint, and they must read and write only the firm's three production buckets.

Security is concerned that a compromised instance could copy data through the endpoint to a bucket in another account, and that stolen credentials could be used to read the production buckets from outside the VPC. The solution must add no hourly endpoint charges.

Which TWO changes meet these requirements? (Choose two.)

Choose two answers.

A. Attach a security group to the S3 gateway endpoint that allows outbound HTTPS only to the company's bucket IP ranges. The security group then filters the endpoint traffic by destination bucket.
B. Attach an endpoint policy to the S3 gateway endpoint that allows S3 actions only on the three production bucket ARNs and their objects.
C. Add a condition to each production bucket policy that allows requests only when aws:SourceVpce matches the S3 gateway endpoint ID, and deny requests that arrive from anywhere else.
D. Replace the gateway endpoint with an interface endpoint for S3, and attach a security group that allows HTTPS from the subnets. The security group then limits which buckets the instances can reach through the endpoint.
E. Give each instance role an IAM policy that lists only the three production buckets, and remove the endpoint policy. The role policies are enough, because the instances are the only callers inside the VPC.

Show the answer and explanation

Answers: B, C

A. Wrong: Gateway endpoints do not use security groups, and S3 does not publish IP ranges for individual buckets. This option describes a control that does not exist for this endpoint type.
B. Right: Correct. The endpoint policy filters every S3 request that enters the VPC through this endpoint, so requests for other buckets are denied whatever the caller permissions. The endpoint stays a gateway endpoint, so there is no hourly charge. Learn more: Gateway endpoints for Amazon S3 (opens in a new tab)
C. Right: Correct. A bucket policy with aws:SourceVpce means the company buckets accept requests only through this endpoint, which blocks direct access from outside the VPC. Together with the endpoint policy, it covers both directions of copying. Learn more: Controlling access to VPC endpoints (opens in a new tab)
D. Wrong: Interface endpoints do use security groups, but the group controls network access to the endpoint, not which buckets can be reached. Bucket limits still need an endpoint policy, and interface endpoints add hourly charges.
E. Wrong: Role policies restrict the instance roles, but any principal that holds other valid credentials, or a role with broader permissions, can still reach other buckets through the endpoint. The endpoint itself would not check the destination bucket.

Explanation

An S3 gateway endpoint policy limits which buckets can be reached through the endpoint, and a bucket policy with aws:SourceVpce limits which requests the buckets accept from the VPC. Security groups do not apply to gateway endpoints, and interface endpoints add cost while still needing an endpoint policy for bucket limits.

The endpoint policy limits which buckets the VPC can reach, and aws:SourceVpce in each bucket policy limits who can reach the bucket.

Study

Want more on Private access to services (VPC endpoints, endpoint policies, PrivateLink, Client VPN)? The 5 full-length practice sets have 6 more Private access to services (VPC endpoints, endpoint policies, PrivateLink, Client VPN) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study Private access to services (VPC endpoints, endpoint policies, PrivateLink, Client VPN)

Control access to VPC endpoints using endpoint policies