Flash card
VPC endpoints: private connectivity from a VPC to AWS services, as gateway endpoints or interface endpoints.
- Gateway endpoints serve S3 and DynamoDB only. They work by route table entry, cost nothing, and cannot be reached from outside the VPC.
- Interface endpoints are PrivateLink: an elastic network interface with a private address in your subnet, billed hourly plus per GB, available for most services.
- Interface endpoints are reachable over VPN and Direct Connect; gateway endpoints are not, which is often the deciding fact.
- Endpoint policies restrict what can be done through the endpoint, which is how a VPC is stopped from reaching buckets outside the organisation.
- Interface endpoints have a security group; gateway endpoints do not, since they are a routing construct.
Pick it when
Pick a gateway endpoint for S3 or DynamoDB from inside the VPC, because it is free. Pick an interface endpoint when the service has no gateway option, when on-premises networks need to reach it, or when a security group on the endpoint is wanted.
It's the wrong answer when
A gateway endpoint is the wrong answer whenever on-premises access is in the requirements, and for any service other than S3 and DynamoDB. Endpoints generally are the wrong answer for controlling access to a resource: an endpoint policy governs traffic through the endpoint, while who may call the API is still IAM.