PRODUCTION SCENARIO
An application runs in private subnets in a VPC and must call Amazon Bedrock. The company's security policy does not allow an internet gateway or a NAT gateway in this VPC.
Which solution will meet these requirements?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: An interface VPC endpoint for Amazon Bedrock
An interface endpoint powered by AWS PrivateLink places an endpoint network interface in each enabled subnet, so the application reaches Amazon Bedrock as if it were inside the VPC, with no internet gateway, NAT device, or public IP address. Gateway endpoints use route table entries and exist only for Amazon S3 and DynamoDB. AWS lists Direct Connect and NAT devices among the connections an interface endpoint replaces, and the policy rules out NAT anyway.