Exam Room · Advanced Security Specialist

Flash Card: VPC Endpoints

January 28, 2028 · 2 min read

Cloud Security · part of The Exam Room

Flash card

VPC endpoints: private connectivity from a VPC to AWS services, as gateway endpoints or interface endpoints.

  1. Gateway endpoints serve S3 and DynamoDB only. They work by route table entry, cost nothing, and cannot be reached from outside the VPC.
  2. Interface endpoints are PrivateLink: an elastic network interface with a private address in your subnet, billed hourly plus per GB, available for most services.
  3. Interface endpoints are reachable over VPN and Direct Connect; gateway endpoints are not, which is often the deciding fact.
  4. Endpoint policies restrict what can be done through the endpoint, which is how a VPC is stopped from reaching buckets outside the organisation.
  5. Interface endpoints have a security group; gateway endpoints do not, since they are a routing construct.

Pick it when

Pick a gateway endpoint for S3 or DynamoDB from inside the VPC, because it is free. Pick an interface endpoint when the service has no gateway option, when on-premises networks need to reach it, or when a security group on the endpoint is wanted.

It's the wrong answer when

A gateway endpoint is the wrong answer whenever on-premises access is in the requirements, and for any service other than S3 and DynamoDB. Endpoints generally are the wrong answer for controlling access to a resource: an endpoint policy governs traffic through the endpoint, while who may call the API is still IAM.

These posts are LLM-aided. Backbone, original writing, and structure by Craig. Research and editing by Craig + LLM. Proof-reading by Craig.