Gateway + Interface
Gateway endpoints for S3/DynamoDB and interface endpoints for SQS, NAT bypass, private DNS, endpoint policies, and cost.
- This builds on The VPC Itself through DNS. Your VPC, subnets, route tables, and security groups must exist.
- In a new terminal session, run the resume script at the end of DNS.
- Read the callout before every step. Predict what will happen, then run it.
Why VPC Endpoints Exist
Goal
Make the problem concrete before introducing the solution.
The cost and security problem without endpoints
What's happening here
Without VPC endpoints, private subnet traffic to AWS services (S3, SQS, ECR, Secrets Manager) follows this path: resource → NAT Gateway → IGW → public internet → AWS service public IP. This is wrong for three reasons:
- Cost: NAT Gateway charges $0.045/GB. Pulling a 1 GB container image from ECR 1000 times = $45 in NAT data transfer alone.
- Security: your data crosses the public internet even though both source and destination are AWS. The hostname resolves to a public IP and leaves your VPC through the IGW.
- Availability: NAT Gateway is a per-AZ single point of failure. If it goes down, all private subnet traffic to AWS services stops.
VPC endpoints solve all three: traffic stays on the AWS backbone, bypasses NAT entirely, and interface endpoints deploy across multiple AZs.
# Show that SQS resolves to a public IP (no endpoint yet)
python3 -c "
import socket, ipaddress
host = 'sqs.us-east-1.amazonaws.com'
ip = socket.gethostbyname(host)
print(f'{host} -> {ip}')
print(f'Is public IP: {not ipaddress.ip_address(ip).is_private}')
"Cost illustration: 500 GB/month of traffic to AWS services:
| Path | Estimated monthly cost |
|---|---|
| Via NAT Gateway | $22.50 |
| Via Interface Endpoint (2 AZs) | $19.40 |
| Via Gateway Endpoint (S3/DynamoDB only) | $0.00: always free |
Gateway Endpoints (S3 and DynamoDB)
Goal
Create a gateway endpoint for S3. Observe the automatic route entry. Understand why this is always free and always correct for S3.