Which of the following should the Solutions Architect do to achieve this target architecture?
(Choose three.)
Enable VPC endpoints for Amazon S3 and DynamoDB.
Disable Private DNS Name Support.
Configure the application on the grid instances to use the private DNS name of the Amazon S3 endpoint.
Populate the on-premises DNS server with the private IP addresses of the EC2 endpoint.
Enable an interface VPC endpoint for EC2.
Configure Amazon S3 endpoint policy to permit access only from the grid nodes.
Explanations:
Enabling VPC endpoints for Amazon S3 and DynamoDB allows private connectivity to these services without internet access, meeting the requirement for the grid instances to communicate privately with S3 and DynamoDB.
Disabling Private DNS Name Support would prevent the grid instances from resolving the AWS service endpoints, complicating connectivity. Private DNS is required to access AWS services without internet access.
Configuring the application to use the private DNS name of the Amazon S3 endpoint is unnecessary if Private DNS is enabled for the VPC endpoints, as AWS services will be accessible via standard DNS names.
Populating the on-premises DNS server with private IPs of the EC2 endpoint is irrelevant since the grid operates in AWS without direct on-premises connectivity or reliance on external DNS for VPC endpoint access.
Enabling an interface VPC endpoint for EC2 allows the job scheduler to privately communicate with the EC2 API to manage grid nodes, meeting the requirement for private EC2 API connectivity without internet access.
Configuring an Amazon S3 endpoint policy to restrict access to the grid nodes enhances security by ensuring only authorized grid instances can access S3, reducing exposure of S3 data to other potential AWS resources.