A company uses an AWS Lambda function that runs in a VPC to transfer files from a legacy SFTP server to Amazon S3. The Lambda function can connect to the SFTP server but times out when uploading to S3. The engineer must fix the timeouts securely and at minimum cost. Which solution meets these constraints?

The Lambda function is timing out because it's in a private subnet and cannot reach S3 directly over the internet. A VPC gateway endpoint for Amazon S3 allows private connectivity from your VPC to S3 without requiring an Internet Gateway, NAT Gateway, or VPN connection. This is a secure and cost-effective solution as gateway endpoints are free of charge. Creating a NAT Gateway would work but incurs hourly charges and data processing charges, making it more expensive. A VPC interface endpoint for S3 would also work but is generally more expensive than a gateway endpoint for S3, as interface endpoints incur hourly charges. Using a VPC internet gateway would expose the Lambda function to the public internet, which is not secure and typically requires the Lambda to be in a public subnet, which is not the case here.