A global firm wants private access from its on-premises data center to an Amazon S3 bucket in us-west-2 without using public IP addresses. The VPC in us-west-2 uses RFC 1918 addressing and is connected to the data center over AWS Direct Connect. Route 53 resolves names inside the VPC and local DNS servers handle on-premises name resolution. What approach lets the on-premises applications download S3 objects using only private addressing?

The correct approach involves creating an S3 interface endpoint and configuring DNS forwarding. An S3 interface endpoint provides private connectivity to S3 via AWS PrivateLink, allowing access using private IP addresses within your VPC and over Direct Connect. This is crucial for avoiding public IP addresses. To enable on-premises applications to resolve S3 service endpoints privately, a Route 53 Resolver inbound endpoint is deployed in the VPC. This inbound endpoint acts as a target for DNS queries originating from on-premises. By configuring the on-premises DNS servers to forward S3 domain queries (e.g., .s3.us-west-2.amazonaws.com) to this inbound endpoint, on-premises applications can resolve the private IP addresses of the S3 interface endpoint. Incorrect options: An S3 interface endpoint alone doesn't automatically reconfigure on-premises applications or their DNS resolution. An S3 gateway endpoint is a free service that provides private access to S3 but does not use private IP addresses from your VPC's subnet range; it relies on route table entries. It also doesn't support access from on-premises over Direct Connect without additional DNS and routing complexities, and it doesn't support PrivateLink.