Gateway vs Interface VPC Endpoints: Private Access to AWS Services

VPC endpoints let private resources reach AWS APIs without traversing the public internet — no NAT gateway, no public IPs. There are two types with very different mechanics, and the exam tests both.

Gateway endpoints — S3 and DynamoDB only

A gateway endpoint adds a route-table entry directing traffic for the service over the AWS network. They exist only for S3 and DynamoDB, carry no hourly charge, and are the standard answer for eliminating NAT data-processing fees on S3/DynamoDB traffic.

Interface endpoints — almost everything else

An interface endpoint (powered by AWS PrivateLink) provisions ENIs with private IPs in your subnets. Most AWS services — SNS, SQS, Secrets Manager, KMS, CloudWatch, and dozens more — are reachable through interface endpoints. They bill hourly per AZ plus per-GB processed.

Choosing

• S3 or DynamoDB access → gateway endpoint (free, no reason not to)
• Any other AWS service → interface endpoint (PrivateLink)
• Third-party SaaS private access → PrivateLink to their endpoint service
• Heavy S3 traffic through NAT → gateway endpoint removes data-processing charges (classic cost question)