A company with a single AWS account runs its internet-facing containerized web application on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The EKS cluster is placed in a private subnet of a VPC. System administrators access the EKS cluster through a bastion host on a public subnet. A new corporate security policy requires the company to avoid the use of bastion hosts. The company also must not allow internet connectivity to the EKS cluster. Which solution meets these requirements MOST cost-effectively?

Question

Quizplus · Accepted Answer

A transit gateway allows the company to connect its VPC to other VPCs and on-premises networks without using a bastion host. It also allows the company to control access to the EKS cluster by using security groups and network access control lists (NACLs).

A Company with a Single AWS Account Runs Its Internet-Facing