AWS VPC Endpoints: Interface vs. Gateway Endpoints

Purpose of This Lesson

VPC endpoints provide private connectivity from resources in a VPC to supported AWS services without sending traffic through the public internet. For the AWS Certified CloudOps Engineer Associate SOA-C03, the key skill is recognizing when to use an interface VPC endpoint versus a gateway VPC endpoint, especially based on service support, routing behavior, and security-group capability.

Key Concepts

• Private connectivity: A VPC endpoint allows VPC resources to reach supported AWS services privately rather than routing through the internet.
• Interface VPC endpoint: Uses an Elastic Network Interface (ENI) with a private IP address in a subnet. It supports many AWS services, uses DNS to redirect traffic, and can have security groups associated with its ENI.
• Gateway VPC endpoint: Supports only Amazon S3 and Amazon DynamoDB. It is configured as a target in a route table and uses prefix lists to redirect traffic.
• Endpoint policies: JSON-based policies can restrict what traffic or access is permitted through an endpoint. The lecture specifically highlights applying endpoint policies with gateway endpoints.
• NAT alternative: Without an appropriate endpoint, a private instance may need a NAT gateway and internet-based routing to reach services whose addresses are publicly exposed, such as S3 or CloudFront examples discussed in the lesson.

VPC Endpoint Architecture and Traffic Flow

A private instance in a VPC may need to access an AWS service. If the service is reached through public addressing, the instance may require a NAT gateway and a route through the internet. A VPC endpoint changes this design by providing private connectivity to supported services.

Interface VPC endpoints

An interface endpoint creates an ENI inside a selected subnet. The ENI receives a private IP address and can be associated with security groups. DNS redirects service traffic to the endpoint, allowing connections to use private IP addressing.

Important characteristics:

• Supports many different AWS services.
• Creates an ENI in the subnet.
• Uses a private IP address.
• Uses DNS to redirect traffic.
• Supports security groups on the endpoint ENI.

Gateway VPC endpoints

A gateway endpoint does not use the interface-endpoint ENI model described above. Instead, it becomes a target in a route table. The route table uses a prefix list to direct traffic privately to the supported service.

Important characteristics:

• Supports S3 and DynamoDB only.
• Requires a route-table entry.
• Uses prefix lists in the route table.
• Does not use the interface endpoint’s security-group model.
• Can use a VPC endpoint policy to define permitted access.

Exam- or Assessment-Relevant Takeaways

The most important assessment decision is to identify the endpoint type from the clues in the scenario:

Requirement or clue	Correct endpoint characteristic
The service is S3 or DynamoDB	Gateway endpoint is an available choice
Many AWS services must be supported	Interface endpoint
The design requires an ENI with a private IP	Interface endpoint
Security groups must be associated with the endpoint	Interface endpoint
Traffic must be redirected through a route-table target	Gateway endpoint
The route uses a prefix list	Gateway endpoint
DNS redirects traffic to private endpoint addresses	Interface endpoint
JSON-based access restrictions are required	Use an endpoint policy; the lecture specifically emphasizes this with gateway endpoints

Do not confuse the two endpoint types merely because both provide private connectivity. The service list and implementation model are decisive.

Tool / Feature Decision Guide

Choose an interface endpoint when:

• The required AWS service is not limited to S3 or DynamoDB.
• The architecture needs an ENI in a subnet.
• Security groups must control traffic to the endpoint.
• DNS-based redirection to a private IP is part of the design.

Choose a gateway endpoint when:

• The target service is S3 or DynamoDB.
• The design should use a route-table target and prefix list.
• You want private connectivity for those supported services without the interface endpoint model.
• Endpoint-policy controls are needed for access through the gateway endpoint.

Do not choose based only on the phrase “private access”

Both endpoint types provide private connectivity. The correct choice depends on the supported service and the endpoint’s networking behavior. A requirement for security groups or an ENI points toward an interface endpoint; a requirement for a route-table prefix-list target points toward a gateway endpoint.

Common Traps / Misconceptions

• Assuming all AWS services use gateway endpoints: Gateway endpoints support only S3 and DynamoDB.
• Forgetting the route-table requirement: Gateway endpoints require a route to be added to the route table.
• Assuming gateway endpoints use security groups: Security groups are associated with the ENI created by an interface endpoint, not with the gateway endpoint model described here.
• Reversing DNS and prefix-list behavior: Interface endpoints use DNS to redirect traffic; gateway endpoints use prefix lists in route tables.
• Thinking endpoint types are interchangeable: They both avoid internet routing, but their supported services and configuration mechanisms differ.
• Treating endpoint policies as a replacement for network configuration: A policy controls permitted endpoint access; it does not remove the need to configure the endpoint’s appropriate networking behavior.

Real-World Engineer / Analyst Notes

• Start endpoint troubleshooting by identifying the endpoint type and checking whether the target AWS service is supported.
• For an interface endpoint, verify that the ENI exists in the intended subnet, has the expected private IP behavior, and has appropriate security-group rules.
• For a gateway endpoint, inspect the route table associated with the workload subnet. Confirm that the relevant prefix-list route is present.
• When private connectivity is the goal, check whether the current design is unnecessarily dependent on a NAT gateway and internet routing.
• Use endpoint policies to narrow access when the architecture requires JSON-based restrictions on sources, destinations, or other policy elements.
• Keep the implementation distinction clear during design reviews: interface endpoints are network interfaces; gateway endpoints are route-table targets.

Quick Reference Summary

Feature	Interface VPC endpoint	Gateway VPC endpoint
Supported services	Many AWS services	S3 and DynamoDB only
Core implementation	ENI in a subnet	Route-table target
Addressing	Private IP on the ENI	Private connectivity through the gateway route
Traffic selection	DNS redirection	Prefix list in the route table
Route-table update	Not the defining mechanism in this lesson	Required
Security groups	Supported on the endpoint ENI	Not the interface-endpoint security-group model
Endpoint policies	Endpoint-policy concept applies; lecture specifically emphasizes gateway use	Supported and highlighted
Main selection clue	Need broad service support, ENI, DNS, or security groups	Need S3/DynamoDB access through a route and prefix list

Flashcards

Q: A private instance must access an AWS service other than S3 or DynamoDB without using internet routing. Which VPC endpoint type should be considered first?

A: Use an interface VPC endpoint because it supports many AWS services and provides connectivity through an ENI with a private IP address.

Q: What two AWS services are supported by gateway VPC endpoints?

A: Amazon S3 and Amazon DynamoDB only.

Q: A design requires security groups to be associated with the endpoint itself. Which endpoint type fits this requirement, and why?

A: An interface endpoint fits because it creates an ENI in a subnet, and that ENI can have a security group.

Q: How does a gateway endpoint direct traffic to its supported service?

A: It is configured as a target in the route table, using a prefix list to redirect traffic privately.

Q: How does an interface endpoint redirect service traffic?

A: It uses DNS to redirect traffic to the endpoint’s private IP address on its ENI.

Q: What configuration item must be added for a gateway endpoint?

A: A route must be added to the relevant route table, with the gateway endpoint used as the target.

Q: Compare the defining implementation components of interface and gateway endpoints.

A: An interface endpoint creates an ENI in a subnet. A gateway endpoint is a route-table target that uses a prefix list.

Q: A team says that every VPC endpoint can support any AWS service. What is the correction?

A: Gateway endpoints are limited to S3 and DynamoDB. Interface endpoints support many different AWS services.

Q: What is the operational significance of an interface endpoint’s ENI?

A: It provides the endpoint with a private IP address and allows security groups to be associated with the endpoint interface.

Q: When is a NAT gateway potentially unnecessary for reaching an AWS service?

A: When the service is supported by an appropriately configured VPC endpoint, allowing private connectivity instead of routing through the internet.

Q: What is the main routing clue that identifies a gateway endpoint in a scenario?

A: The route table contains a prefix-list route whose target is the gateway endpoint.

Q: What can a VPC endpoint policy define?

A: It is a JSON-based policy that can define permitted sources, destinations, and other policy elements for endpoint access.

Practice Questions

Question 1

A private EC2 instance must access DynamoDB. The networking team wants traffic to remain private and expects to configure the connection as a route-table target using a prefix list. Which option is appropriate?

A. An interface VPC endpoint with a security group
B. A gateway VPC endpoint with a route-table entry
C. A NAT gateway with an internet gateway route
D. A public IP address on the EC2 instance

Correct answer: B. Gateway endpoints support DynamoDB and use a route-table target with a prefix list for private traffic.

Question 2

An application must privately access an AWS service that is not S3 or DynamoDB. The security team also requires security groups on the endpoint connection. What should the engineer select?

A. A gateway VPC endpoint
B. An interface VPC endpoint
C. A gateway endpoint with a prefix list only
D. A public service endpoint through an internet gateway

Correct answer: B. Interface endpoints support many AWS services, create an ENI with a private IP, and allow security groups to be associated with that ENI.

Question 3

A gateway endpoint has been created for S3, but workloads in a subnet cannot use it. Which missing configuration is the most likely issue based on the lesson?

A. A security group on an endpoint ENI
B. A DNS record for the interface endpoint
C. A route-table entry targeting the gateway endpoint
D. A public IP address assigned to the workload

Correct answer: C. Gateway endpoints require a route-table entry and use a prefix list to redirect traffic.

Question 4

During a design review, one engineer proposes a gateway endpoint because it provides private access, but the workload needs a service outside S3 and DynamoDB. What is the decisive reason to reject that proposal?

A. Gateway endpoints cannot provide private connectivity
B. Gateway endpoints require an internet gateway
C. Gateway endpoints support only S3 and DynamoDB
D. Gateway endpoints always require a security group

Correct answer: C. Private connectivity alone does not determine the endpoint type; gateway service support is limited to S3 and DynamoDB.

WordPress Metadata

Suggested Slug:
aws-vpc-endpoints-interface-gateway-soa-c03

Meta Description:
Study the differences between AWS interface and gateway VPC endpoints, including supported services, routing, security groups, DNS, prefix lists, and endpoint policies.

Tags:
AWS, VPC, VPC endpoints, interface endpoints, gateway endpoints, S3, DynamoDB, security groups, route tables, SOA-C03