Securing Connectivity between VPCs and Other Public AWS Services

Many services allow you to create resources that require a VPC. EC2 instances and RDS databases are examples. Other AWS services do not deploy resources within your VPC. For example, Amazon S3 buckets are in public AWS environments and not within your VPC. If your EC2 instances require access to these buckets, perhaps to upload or download objects, then you need to consider how network traffic from your instance reaches those buckets. As a default network configuration, your VPC will have an internet gateway. This means traffic from those EC2 instances must first traverse the internet gateway to access S3 buckets in public AWS space.

You can access various AWS services and resources from your EC2 instances deployed within a VPC. Often, this requires traffic to traverse from the VPC to the internet and back in again to those public AWS services. For EC2 instances located within private subnets, you must also deploy...