2 lab guides

VPC Endpoints

Gateway and interface endpoints, endpoint policies, and fully private workload design.

Outcome

Gateway + Interface
- Explain the three problems with routing AWS service traffic through NAT Gateway (cost, security, availability)
- Explain the difference between a gateway endpoint (route table entry) and an interface endpoint (ENI with private IP)
- Create an S3 gateway endpoint, associate it with multiple route tables, explain the prefix list route it adds
- Explain why the gateway endpoint is always free and always correct for S3 and DynamoDB
- Create an SQS interface endpoint with private DNS and explain what private DNS changes about resolution
- Explain why enableDnsSupport and enableDnsHostnames both must be true for private DNS to work
- Create an endpoint security group and explain what happens if port 443 is blocked (timeout, not AccessDenied)
- Explain why creating an interface endpoint without --private-dns-enabled means it is silently unused
Policies & Private Workloads
- Apply an endpoint policy and explain the three-layer access control model (IAM + endpoint policy + resource policy)
- List the eight endpoints required for a fully private Fargate workload, including both ECR endpoints
- Explain the S3 exfiltration prevention pattern using endpoint policy aws:ResourceAccount condition