Interface and Gateway VPC Endpoints Explained

VPC endpoints let resources in a VPC access supported AWS services privately without requiring an Internet gateway or NAT device. The two classic endpoint types are Interface endpoints and Gateway endpoints.

This is Part 45 of the AWS Cloud Practitioner Study Notes. The quickest exam rule is:

S3 or DynamoDB from a VPC
→ Gateway endpoint is the classic answer

Most other supported AWS services
→ Interface endpoint powered by AWS PrivateLink

There is an important current nuance: Amazon S3 and DynamoDB now support both Gateway and Interface endpoints. Gateway endpoints are usually the simple, no-additional-charge choice for in-VPC access; Interface endpoints can be useful for private IP access from on-premises networks, peered VPCs, or other supported network paths.

What problem does a VPC endpoint solve?

Suppose an EC2 instance in a private subnet needs to read a secret from Secrets Manager or upload a backup to S3. A private subnet does not have a direct route to an Internet gateway. Without a private endpoint, you may need a NAT gateway or another connectivity design.

Private EC2
        ↓
VPC endpoint
        ↓
AWS managed service

The application uses the AWS service, while the endpoint provides the private connectivity path. The VPC endpoint does not place the AWS managed service inside your VPC; it provides a private access point to that service.

Interface VPC endpoints

An Interface VPC endpoint is powered by AWS PrivateLink. AWS creates endpoint network interfaces (ENIs) with private IP addresses in the subnets you select.

Private EC2
        ↓
Interface endpoint ENI
        ↓
AWS PrivateLink
        ↓
AWS service or supported endpoint service

Interface endpoints are used for many AWS services and supported partner or customer endpoint services. Examples commonly encountered in exams and production designs include:

• AWS Secrets Manager
• AWS Systems Manager and Parameter Store APIs
• Amazon SQS and Amazon SNS
• AWS Key Management Service (KMS)
• Amazon ECR API and Docker Registry endpoints
• CloudWatch Logs and CloudWatch Monitoring APIs
• AWS STS
• Amazon EventBridge
• AWS Step Functions
• Amazon API Gateway private APIs
• Supported partner SaaS services

The exact service list varies by Region. Check the AWS services that integrate with AWS PrivateLink when designing a current architecture.

Interface endpoint properties

• Creates an ENI in selected subnets.
• Uses private IP addresses.
• Uses a security group attached to the endpoint ENI.
• Can use private DNS so normal AWS service hostnames resolve to private endpoint addresses.
• Is normally deployed across multiple AZs for resilience.
• Has endpoint-hour and data-processing charges according to the service and pricing model.

The endpoint security group must allow the expected traffic from the client security group, commonly HTTPS on TCP port 443. The client security group, network ACLs, DNS settings, and endpoint policy must also permit the request.

Example: EC2 to Secrets Manager

An API needs a database password:

Private EC2 application
        ↓ HTTPS
Secrets Manager Interface endpoint ENI
        ↓
Secrets Manager

The EC2 instance does not need a public IP, Internet gateway, or NAT gateway solely to call Secrets Manager. The application still needs the correct IAM permissions, such as permission to call secretsmanager:GetSecretValue.

Gateway VPC endpoints

Gateway endpoints provide private connectivity from a VPC to Amazon S3 or Amazon DynamoDB. Unlike Interface endpoints, Gateway endpoints do not use AWS PrivateLink and do not create endpoint ENIs.

Private EC2
        ↓
Route table prefix-list route
        ↓
Gateway endpoint
        ↓
S3 or DynamoDB

When you create a Gateway endpoint, you associate it with route tables. The route sends traffic destined for the supported service to the endpoint. Subnets whose route tables are not associated with the endpoint do not use that Gateway endpoint.

Gateway endpoint properties

• Supports Amazon S3 and Amazon DynamoDB.
• Uses route tables and AWS-managed prefix lists.
• Does not create an ENI.
• Does not have a security group attached to the endpoint itself.
• Does not require an Internet gateway or NAT device for the VPC-to-service path.
• Has no additional charge for using the Gateway endpoint; normal S3 or DynamoDB charges still apply.

The client instances’ security groups and network ACLs still matter. For example, outbound HTTPS and the relevant service prefix-list or service IP ranges must be allowed according to the network design. You can also attach an endpoint policy to restrict which principals and resources can use the endpoint.

Example: private EC2 to S3

Private EC2
        ↓
S3 Gateway endpoint
        ↓
Amazon S3

This avoids using a NAT gateway merely to reach S3 and avoids NAT data-processing charges for that path. The S3 bucket policy can also restrict access using the VPC endpoint condition key aws:sourceVpce.

Interface versus Gateway endpoint

Feature	Interface endpoint	Gateway endpoint
Main technology	AWS PrivateLink	VPC route-table endpoint
Typical services	Many AWS and supported partner services	S3 and DynamoDB
Endpoint ENI	Yes	No
Private IP address	Yes, on endpoint ENIs	Not as an endpoint ENI
Endpoint security group	Yes	No endpoint security group
Configuration	Select subnets, security group, DNS, and policy	Associate endpoint with route tables and policy
Private subnet needs NAT for that service path	No	No
Additional endpoint pricing	Usually hourly and data processing	No additional Gateway endpoint charge
Common answer	EC2 to Secrets Manager or SQS	EC2 to S3 or DynamoDB

S3 and DynamoDB: the current nuance

For Cloud Practitioner questions, memorise Gateway endpoints for S3 and DynamoDB. In current AWS documentation, both services can also be reached with Interface endpoints powered by PrivateLink.

Why might an organisation use an Interface endpoint for S3 or DynamoDB?

• An on-premises network needs private access through Direct Connect or Site-to-Site VPN.
• A peered VPC or Transit Gateway design needs a private IP-based access path.
• The architecture needs Interface endpoint behavior or endpoint-specific DNS names.

For ordinary in-VPC access, a Gateway endpoint is often the simpler and lower-cost design. A Gateway endpoint cannot provide the same access paths from on-premises networks, peered VPCs in other Regions, or through a Transit Gateway in the general Gateway endpoint model.

VPC endpoints versus resources inside your VPC

Not every AWS service call requires a VPC endpoint. Resources that are deployed inside the same VPC communicate using private IP addresses and normal VPC routing.

Examples include:

• EC2 to RDS or Aurora
• EC2 to ElastiCache
• EC2 to a VPC-mode OpenSearch domain
• EC2 to a load balancer
• One VPC resource to another VPC resource

EC2
  │ private IP
  ▼
RDS

By contrast, Secrets Manager, SQS, KMS, and the S3 API are AWS-managed service APIs outside the workload VPC. Use a suitable endpoint when private access is required.

The specific service architecture matters. For example, an ECS task may run inside a VPC, but the ECS control-plane API, ECR APIs, and S3 image-layer storage are separate service endpoints. A private ECS task pulling an ECR image may need ECR API and Docker Registry Interface endpoints plus an S3 Gateway endpoint, depending on the deployment and image path.

NAT Gateway and NAT Instance

NAT is for a different purpose from a VPC endpoint.

VPC endpoint
→ Private access to a supported AWS service

NAT Gateway
→ Outbound Internet access from private subnets

A private EC2 instance may use a NAT gateway to download operating-system updates, call a public API, or download a package from the Internet. The Internet cannot initiate a connection to the private instance through the NAT path.

NAT Gateway is the managed option generally preferred for new designs. A NAT Instance is an EC2-based, older approach that you manage yourself, including its operating system, patching, scaling, routing, and high availability.

Private EC2
        ↓
NAT Gateway or NAT Instance
        ↓
Internet gateway
        ↓
Public Internet

Do not choose NAT when the requirement is “private access to S3 or Secrets Manager.” Choose the appropriate VPC endpoint instead when the service supports it.

AWS VPN CloudHub is different

AWS VPN CloudHub connects multiple customer networks through a virtual private gateway and VPN connections. It is for site-to-site communication, not for private EC2 access to an AWS service API.

Office A ── VPN ──┐
Office B ── VPN ──┼── AWS VPN CloudHub
Office C ── VPN ──┘

For example, a company with offices in Singapore, Malaysia, and Thailand can use a hub-and-spoke design so the sites communicate through AWS. The traffic remains within VPN connections rather than using the public Internet as an unencrypted path.

VPC endpoint
→ VPC or workload to AWS service

VPN CloudHub
→ Customer site to customer site

NAT
→ Private subnet to public Internet

Practical decision tree

What does the workload need?
        │
        ├── Access to a resource already inside the VPC
        │       → Normal private VPC routing
        │
        ├── Access to S3 or DynamoDB from inside the VPC
        │       → Gateway endpoint (classic answer)
        │       → Interface endpoint for special private-network paths
        │
        ├── Access to Secrets Manager, SQS, KMS, ECR, or another
        │   supported AWS service without Internet access
        │       → Interface endpoint
        │
        ├── Outbound access to public package repositories or APIs
        │       → NAT Gateway, or legacy NAT Instance
        │
        └── Communication between multiple customer offices
                → AWS VPN CloudHub or another site-to-site design

Common architectures

Private EC2 reads a secret

EC2
  ↓
Secrets Manager Interface endpoint
  ↓
Secret value

The endpoint provides network reachability; IAM determines whether the application may read the secret.

Private EC2 uploads a backup to S3

EC2
  ↓
S3 Gateway endpoint
  ↓
S3 bucket

The route table, endpoint policy, IAM policy, and bucket policy must all allow the request.

Private Lambda function calls Secrets Manager

A Lambda function configured for a VPC can use an Interface endpoint to call Secrets Manager without requiring a NAT gateway for that call. The function still needs a subnet, security-group, DNS, and IAM configuration that allow the request.

Common exam questions

A private EC2 instance needs to access S3 without using the Internet.

Gateway VPC endpoint.

A private EC2 instance needs to retrieve a secret without Internet access.

Interface VPC endpoint for Secrets Manager.

Which endpoint type creates an ENI with private IP addresses?

Interface endpoint.

Which endpoint type uses route tables and supports S3 and DynamoDB?

Gateway endpoint.

Three branch offices need secure communication through AWS.

AWS VPN CloudHub.

A private instance needs to download updates from the public Internet.

NAT Gateway, or a NAT Instance in a legacy design.

Final memory map

Gateway endpoint
→ S3 and DynamoDB
→ route table
→ no endpoint ENI

Interface endpoint
→ most supported AWS services
→ AWS PrivateLink
→ ENI and security group

NAT Gateway
→ private subnet to public Internet

VPN CloudHub
→ customer site to customer site

The central distinction is: a VPC endpoint provides private access to a supported service; NAT provides outbound Internet access; VPN CloudHub connects customer networks.

Sources

• Gateway VPC endpoints
• Interface VPC endpoints
• AWS services that integrate with AWS PrivateLink
• AWS PrivateLink for DynamoDB
• AWS PrivateLink for S3