Which solution will meet these requirements?
Create a VPC Endpoint Service that accepts TCP traffic, host it behind a Network Load Balancer, and make the service available over DX.
Create a VPC Endpoint Service that accepts HTTP or HTTPS traffic, host it behind an Application Load Balancer, and make the service available over DX.
Attach an internet gateway to the VPC, and ensure that network access control and security group rules allow the relevant inbound and outbound traffic.
Attach a NAT gateway to the VPC, and ensure that network access control and security group rules allow the relevant inbound and outbound traffic.
Explanations:
A VPC Endpoint Service with TCP traffic can be used to connect on-premises services to AWS over Direct Connect (DX), ensuring the traffic does not traverse the internet. The service can be hosted behind a Network Load Balancer, making it accessible to other AWS customers via DX.
VPC Endpoint Services that support HTTP/HTTPS traffic are designed for communication over the AWS network, not for private connections over Direct Connect. This solution would require the traffic to traverse the internet, which violates the requirement for avoiding internet traversal.
Attaching an internet gateway allows traffic to traverse the internet. This option would not meet the requirement of keeping sensitive data off the internet. It introduces an unsecured route for traffic, which is not acceptable for sensitive data.
A NAT gateway facilitates outbound internet traffic for instances in a private subnet. This option does not meet the requirement, as it enables internet connectivity, which conflicts with the need to keep the traffic off the internet.
If I’m not mistaken, the answer is:
Create a VPC Endpoint Service that accepts TCP traffic, host it behind a Network Load Balancer, and make the service available over DX.