VPC Endpoints

Correct Answer: Gateway Endpoint

A Gateway Endpoint is a VPC Endpoint that provides VPC access to AWS services, such as DynamoDB and Amazon S3. It is a cost-effective and highly reliable option for minimizing data transfer costs and reducing the data exposure risk.

Correct Answer: Resource Policy

Use a resource-based policy on the target service (for example, an S3 bucket policy) to both allow only specific AWS account principals and require that access comes via a particular VPC endpoint using a condition such as aws:SourceVpce. This enforces the restriction at the resource across all callers and network paths. A VPC endpoint policy can limit which actions/resources are accessible through that endpoint, but it cannot ensure the resource is inaccessible via other paths or restrict by specific external accounts. IAM identity policies apply to principals, not the resource, and cannot protect the resource from other principals. Security groups control network reachability, not account-level authorization to the managed service API.

Correct Answer: Gateway Endpoint

A Gateway Endpoint enables private connectivity from your VPC to supported AWS services without traversing the public internet. Amazon DynamoDB is supported only by Gateway Endpoints (along with Amazon S3). Interface Endpoints (AWS PrivateLink) are used for many other AWS services but not for DynamoDB. "Public Endpoint" and "Regional Endpoint" are not VPC endpoint types, and using them would not ensure traffic stays off the public internet. Therefore, to privately access DynamoDB from a VPC, use a Gateway Endpoint.