Hi @andvm 

During SDDC deployment you can choose the AWS VPC which the VMC on AWS is connected to. You can create a new one from scratch or use an existing VPC.

When you enable service access s3 it means that the VMs living inside the VMware Cloud on AWS will get propagated a route (and access) to the S3 endpoint which lives in the private network of the VPC (which is not known to the VMs). Don't forget to create the NSX rules for allowing the VMs to access the resource on VMC (172.16.x.x)!

I think this link will clarify some points of the VMC on AWS to VPC and ENI traffic: https://docs.vmware.com/en/VMware-Cloud-on-AWS/solutions/VMware-Cloud-on-AWS.c4d719788a38caf2d159924...

Regards

Daniel