AWS VPC Endpoints are virtual devices that enable private connectivity between your VPC and AWS services without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect. They provide a secure, scalable way to access AWS services from within your VPC while keeping traffic within the AWS network backbone.
VPC endpoints are horizontally scaled, redundant, and highly available VPC components that allow communication between instances in your VPC and AWS services without imposing availability risks or bandwidth constraints on your network traffic.
Route table-based endpoints for S3 and DynamoDB. Traffic is routed through your VPC route table to the service.
ENI-based endpoints with private IP addresses for most AWS services. Uses AWS PrivateLink technology.
Endpoints for third-party virtual appliances like firewalls, intrusion detection systems, and deep packet inspection systems.
| Feature | Gateway Endpoint | Interface Endpoint |
|---|---|---|
| Supported Services | S3, DynamoDB | Most AWS services (EC2, Lambda, SNS, SQS, etc.) |
| Implementation | Route table entries | Elastic Network Interface (ENI) |
| DNS Resolution | Uses service's public DNS names | Private DNS names available |
| Pricing | No additional charges | Hourly charges + data processing |
| Availability Zones | Regional (all AZs) | Specific AZs (recommended: multiple) |
Traffic never leaves the AWS network, reducing exposure to internet-based attacks and eliminating the need for internet gateways.
Lower latency and higher throughput by keeping traffic within AWS's high-speed backbone network.
Reduce NAT Gateway costs and data transfer charges by eliminating internet routing for AWS service communications.
Meet regulatory requirements by ensuring data doesn't traverse the public internet.
aws ec2 create-vpc-endpoint \
--vpc-id vpc-12345678 \
--service-name com.amazonaws.us-east-1.s3 \
--route-table-ids rtb-12345678 rtb-87654321 \
--region us-east-1aws ec2 create-vpc-endpoint \
--vpc-id vpc-12345678 \
--service-name com.amazonaws.us-east-1.lambda \
--route-table-ids rtb-12345678 \
--subnet-ids subnet-12345678 subnet-87654321 \
--security-group-ids sg-12345678 \
--private-dns-enabled \
--region us-east-1aws ec2 create-vpc-endpoint \
--vpc-id vpc-12345678 \
--service-name com.amazonaws.us-east-1.s3 \
--route-table-ids rtb-12345678 \
--policy-document file://s3-endpoint-policy.json \
--region us-east-1{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::my-company-bucket",
"arn:aws:s3:::my-company-bucket/*"
],
"Condition": {
"StringEquals": {
"aws:PrincipalVpc": "vpc-12345678"
}
}
}
]
}aws ec2 describe-vpc-endpoints \
--filters Name=vpc-id,Values=vpc-12345678 \
--region us-east-1aws ec2 modify-vpc-endpoint \
--vpc-endpoint-id vpce-12345678 \
--policy-document file://updated-s3-endpoint-policy.json \
--region us-east-1aws ec2 modify-vpc-endpoint \
--vpc-endpoint-id vpce-12345678 \
--add-route-table-ids rtb-11111111 rtb-22222222 \
--region us-east-1aws ec2 modify-vpc-endpoint \
--vpc-endpoint-id vpce-12345678 \
--remove-route-table-ids rtb-11111111 \
--region us-east-1aws ec2 delete-vpc-endpoint \
--vpc-endpoint-id vpce-12345678 \
--region us-east-1aws ec2 create-vpc-endpoint \
--vpc-id vpc-12345678 \
--service-name com.amazonaws.us-east-1.ec2 \
--subnet-ids subnet-1a111111 subnet-1b222222 subnet-1c333333 \
--security-group-ids sg-12345678 \
--private-dns-enabled \
--region us-east-1aws cloudwatch get-metric-statistics \
--namespace AWS/VpcFlowLogs \
--metric-name PacketDrop \
--dimensions Name=VpcId,Value=vpc-12345678 \
--start-time 2025-07-01T00:00:00Z \
--end-time 2025-07-01T23:59:59Z \
--period 3600 \
--statistics Sumaws ec2 create-flow-logs \
--resource-type VPC \
--resource-ids vpc-12345678 \
--traffic-type ALL \
--log-destination-type cloud-watch-logs \
--log-group-name VPCFlowLogs \
--deliver-logs-permission-arn arn:aws:iam::123456789012:role/flowlogsRoleDeploy interface endpoints across multiple Availability Zones to ensure resilience against AZ failures.
Configure restrictive security groups for interface endpoints, allowing only necessary ports and protocols.
Use endpoint policies to implement fine-grained access control and adhere to principle of least privilege.
Enable VPC Flow Logs and CloudWatch monitoring to track endpoint usage and troubleshoot issues.
Enable private DNS for interface endpoints to use familiar service DNS names without code changes.
Implement consistent tagging for endpoints to enable cost tracking, automation, and resource management.
Network ACLs: Ensure subnet Network ACLs allow traffic to/from VPC endpoint IP ranges.
Route Table Priority: VPC endpoint routes take precedence over internet gateway routes for AWS services.
Cross-Account Access: Use resource-based policies and endpoint policies together for secure cross-account scenarios.
Private DNS: Verify that your VPC has DNS resolution and DNS hostnames enabled for private DNS to work.
Start with gateway endpoints for S3 and DynamoDB for immediate cost savings, then gradually implement interface endpoints for other services based on your security and compliance requirements.