A single VPC has public and private subnets across two Availability Zones. Static website content (images) is stored in Amazon S3. Web servers are EC2 instances in private subnets, in an Auto Scaling group behind an ALB. The environment uses Direct Connect with a public VIF to access S3. A network engineer finds EC2-to-S3 traffic is traversing a NAT gateway, increasing costs as traffic scales. How should the engineer change connectivity to avoid NAT gateway charges for S3 traffic?

Gateway VPC endpoints provide private connectivity from your VPC to S3 without requiring an internet gateway, NAT device, VPN connection, or Direct Connect. This eliminates NAT gateway charges for S3 traffic because the traffic flows directly from the EC2 instances to S3 over the AWS network backbone. You must update the VPC route table to direct S3-bound traffic to the gateway endpoint. Interface VPC endpoints are used for services that support PrivateLink, which S3 does not. A Direct Connect private VIF is for private IP space and would not connect to public S3 endpoints. Creating a Site-to-Site VPN tunnel over a public VIF would still route traffic through a NAT gateway or require an internet gateway for S3 access, not solving the cost issue.