VPC Endpoints: Private Access to AWS Services

A VPC endpoint lets resources in a VPC connect privately to supported AWS services without sending that service traffic through a public Internet path. This is particularly useful for private subnets, where an application may need to reach Amazon S3, DynamoDB, Systems Manager, Secrets Manager, or another AWS service without requiring a NAT Gateway.

This is Part 27 of the AWS Cloud Practitioner Study Notes series. Part 24 introduced VPCs and subnets, while Part 25 compared Internet, NAT, VPN, and Transit Gateways.

What problem does a VPC endpoint solve?

Imagine a private EC2 instance that needs to read an object from an S3 bucket.

Without an endpoint, a common design is:

Private EC2 → NAT Gateway → Internet Gateway → S3 public endpoint

This requires a NAT Gateway, a route to it, and the associated hourly and data-processing charges. The request uses a public AWS service endpoint even though the destination is an AWS service.

With a gateway endpoint for S3, the route is private to the VPC/AWS service path:

Private EC2 → VPC gateway endpoint → Amazon S3

The endpoint does not provide general Internet access. It provides private connectivity to the supported service, which is an important distinction from an Internet Gateway or NAT Gateway.

The two endpoint types to remember

Feature	Gateway endpoint	Interface endpoint
Main AWS examples	Amazon S3 and DynamoDB	Systems Manager, Secrets Manager, CloudWatch, KMS, SQS, SNS, and many other services
How traffic is directed	Route-table entry	Private IP address on an endpoint network interface
AWS PrivateLink	Not used	Used
Network interface	No endpoint ENI	Requester-managed ENI in each selected subnet
Security groups	No endpoint ENI security group	Security group attached to the endpoint ENI
DNS requirement	Usually route-table based	Private DNS commonly maps the service hostname to private endpoint IPs
Endpoint charge	No additional hourly endpoint charge	Hourly charge per AZ plus data-processing charges
Exam shortcut	S3 or DynamoDB	Most other supported AWS services

The service catalogue changes over time, and some services support more than one endpoint option. For the Cloud Practitioner exam, remember the standard mapping: gateway endpoints are for S3 and DynamoDB; interface endpoints cover many other AWS services.

Gateway endpoints

Gateway endpoints provide private access to Amazon S3 and Amazon DynamoDB from a VPC. They are configured as a target in one or more route tables used by the subnets that need the service.

Gateway endpoints have these characteristics:

• They use route tables rather than endpoint network interfaces.
• They do not require an Internet Gateway or NAT Gateway for the supported service path.
• They have no additional hourly endpoint charge.
• You can attach an endpoint policy to control which principals and resources can use the endpoint.
• They are regional: an endpoint connects to the service in its AWS Region.

For example, a private subnet route table can contain a route for the S3 prefix list that targets the gateway endpoint. An EC2 instance in that subnet can then access S3 without a public IP address or NAT Gateway.

Gateway endpoints are deliberately scoped. A DynamoDB gateway endpoint cannot be used as a general path to the Internet, and gateway endpoint access has limitations for traffic originating outside the VPC, such as from on-premises networks, a peered VPC in another Region, or through a Transit Gateway. Choose the endpoint type and network design based on where the client actually runs.

Gateway endpoint example

VPC: 10.0.0.0/16
└── Private subnet: 10.0.1.0/24
    └── EC2 application
        └── Route table → S3 gateway endpoint → Amazon S3

The EC2 instance still needs IAM permission to use the bucket, and the S3 bucket policy may also restrict access. A VPC endpoint does not replace identity or resource-based authorization.

Interface endpoints and AWS PrivateLink

An interface endpoint uses AWS PrivateLink. AWS creates a requester-managed elastic network interface (ENI) with a private IP address in each subnet selected for the endpoint. Applications connect to that private address, normally through the service’s DNS name.

Interface endpoints are used for many AWS services, including:

• AWS Systems Manager and its related services
• AWS Secrets Manager
• Amazon CloudWatch and CloudWatch Logs
• AWS Key Management Service (KMS)
• Amazon SQS and Amazon SNS
• Amazon API Gateway
• Many other services that support AWS PrivateLink

For example, a private EC2 instance retrieving a secret can use this path:

Private EC2 → private DNS name → interface endpoint ENI → Secrets Manager

The EC2 instance does not need a public IP address, Internet Gateway, or NAT Gateway for this service connection.

Interface endpoint design considerations

When creating an interface endpoint, consider the following:

• Subnets and Availability Zones: Select subnets in the Availability Zones where the workloads run. This improves resilience and avoids depending on a cross-AZ path.
• Security groups: Attach a security group to the endpoint ENI that allows the required traffic, commonly HTTPS/TCP 443 from the workload security group.
• DNS: Private DNS lets the normal AWS service hostname resolve to the endpoint’s private IP addresses. VPC DNS hostnames and DNS resolution must be enabled for this behaviour.
• Network ACLs: The subnet NACL must allow the request and response traffic. Part 26 explains why the endpoint security group is stateful while a NACL is stateless.
• Cost: Interface endpoints are charged hourly for each Availability Zone endpoint and for data processed. The exact price depends on Region and current AWS pricing.

Selecting only one Availability Zone can be cheaper, but it creates a dependency on that zone and may result in cross-AZ traffic for workloads elsewhere. Production designs commonly create endpoints in multiple required AZs and then compare resilience, data-transfer, and endpoint costs.

Endpoint policies do not replace IAM

An endpoint policy is a resource-based policy attached to a VPC endpoint. It can restrict which principals, actions, or resources are allowed through that endpoint.

Access normally has to satisfy all relevant controls:

1. The route, DNS, and endpoint network path must work.
2. The endpoint policy must allow the request, when endpoint policies are supported and restricted.
3. The IAM identity policy must allow the action.
4. The AWS service resource policy, such as an S3 bucket policy, must allow the request when applicable.

The default endpoint policy generally allows full access to the supported service. A more restrictive policy can reduce the blast radius of a compromised workload, but it is not a replacement for least-privilege IAM.

VPC endpoint versus NAT Gateway

Question	VPC endpoint	NAT Gateway
Primary purpose	Private access to a supported AWS service or endpoint service	Outbound Internet access for private resources
Destination	Specific supported service	Public Internet destinations
Public IP required on workload?	No	No, but the NAT Gateway uses a public path through an Internet Gateway
Typical private-subnet route	Service-specific endpoint route or private endpoint DNS	0.0.0.0/0 → NAT Gateway
Cost model	Gateway: no additional hourly endpoint charge; interface: hourly plus data processing	Hourly plus data processing and related networking charges
General Internet access	No	Yes, outbound only

Use a VPC endpoint when a private workload needs a supported AWS service. Use a NAT Gateway when that workload needs outbound access to public package repositories, external APIs, websites, or other Internet destinations. A real architecture may need both.

Common examples

Requirement	Typical choice	Why
Private EC2 reads from S3	S3 gateway endpoint	Route-table-based private access with no additional hourly endpoint charge
Private EC2 writes to DynamoDB	DynamoDB gateway endpoint	Gateway endpoint is the standard private VPC path
Private EC2 reads a Secrets Manager secret	Secrets Manager interface endpoint	Secrets Manager is accessed through an interface endpoint and private ENI
Private EC2 uses Systems Manager	Systems Manager interface endpoints	Systems Manager needs the relevant supported service endpoints and DNS/network access
Private EC2 downloads from a public package repository	NAT Gateway	The destination is the public Internet, not a VPC endpoint service

Troubleshooting a VPC endpoint connection

When a private workload cannot reach an AWS service, check the path in this order:

1. Confirm the AWS service and Region support the chosen endpoint type.
2. For a gateway endpoint, confirm the workload subnet’s route table is associated with the endpoint.
3. For an interface endpoint, confirm the endpoint ENI exists in the required subnet and its security group allows the traffic.
4. Confirm VPC DNS hostnames and DNS resolution are enabled when private DNS is being used.
5. Check the subnet NACL in both directions.
6. Check IAM permissions, the endpoint policy, and the service resource policy.
7. Check the workload’s route table and verify that the request is not incorrectly being sent to a NAT Gateway.

Cloud Practitioner exam notes

• A VPC endpoint provides private connectivity from a VPC to a supported AWS service or endpoint service.
• Gateway endpoint: Amazon S3 and DynamoDB; route-table based; no endpoint ENI; no additional hourly endpoint charge.
• Interface endpoint: AWS PrivateLink; private ENI and private IP address; security group; hourly and data-processing charges.
• An endpoint is not a general-purpose Internet connection.
• NAT Gateway provides outbound Internet access; it is not the same as a VPC endpoint.
• Private DNS allows a familiar AWS service hostname to resolve to interface endpoint private IP addresses.
• Endpoint policies add another authorization layer; they do not override IAM or service resource policies.
• For high availability, deploy interface endpoints in the Availability Zones that need them.
• Private EC2 to S3 is the classic gateway endpoint example.
• Private EC2 to Secrets Manager or Systems Manager is the classic interface endpoint example.

Final takeaway

VPC endpoints keep supported AWS service traffic private and can remove the need for a NAT Gateway for those destinations. The exam decision is usually simple:

S3 or DynamoDB → gateway endpoint.

Many other AWS services → interface endpoint powered by AWS PrivateLink.

Then check the practical details: route tables for gateway endpoints, ENIs and security groups for interface endpoints, private DNS, endpoint policies, Availability Zones, and cost.

Sources

• Gateway endpoints for Amazon S3 and DynamoDB
• Create an interface endpoint
• Access AWS services through AWS PrivateLink
• Control access to VPC endpoints using endpoint policies
• AWS PrivateLink concepts