Study guide
Technical reference and lesson notes
This lesson explains how VPC endpoints allow resources inside an Amazon VPC to privately access supported AWS services without sending traffic over the public internet.
For the AWS Certified Solutions Architect – Professional SAP-C02 exam, VPC endpoints are important because they appear in scenarios involving:
- Private subnet access to AWS services
- Reducing dependency on NAT gateways
- Improving security by avoiding internet-routed traffic
- Controlling access to Amazon S3, DynamoDB, and other AWS services
- Designing secure, cost-aware, and highly available VPC architectures
The main exam focus is understanding the difference between interface endpoints and gateway endpoints.
Key Concepts
What Are VPC Endpoints?
A VPC endpoint allows resources inside a VPC to connect privately to supported AWS services.
Without a VPC endpoint, a private EC2 instance often needs a route through a NAT gateway to reach public AWS service endpoints such as Amazon S3. Even though the destination is an AWS service, the normal service endpoint may use public IP addressing.
A VPC endpoint changes the design by allowing traffic to stay on the AWS private network instead of requiring internet-facing routing.
Common reasons to use VPC endpoints include:
- Keeping traffic private
- Reducing exposure to the public internet
- Avoiding the need for NAT gateway access for certain AWS service calls
- Improving security controls around service access
- Simplifying private subnet architectures
The Two Main Types of VPC Endpoints
There are two endpoint types you need to understand for the exam:
- Interface VPC Endpoints
- Gateway VPC Endpoints
They both provide private connectivity to AWS services, but they work very differently.
Interface VPC Endpoints
An interface endpoint uses an Elastic Network Interface, or ENI, inside your VPC subnet.
That ENI receives a private IP address from the subnet. Resources in the VPC then use that private IP path to communicate with the supported AWS service.
Interface endpoints are powered by AWS PrivateLink and support many AWS services.
Key Characteristics of Interface Endpoints
Interface endpoints:
- Create one or more ENIs in selected subnets
- Use private IP addresses
- Support many AWS services
- Can use security groups
- Use DNS to redirect service traffic to the private endpoint
- Are commonly used when private workloads need to call AWS APIs or supported AWS services
Security Groups with Interface Endpoints
A major exam point is that interface endpoints can use security groups.
Because an interface endpoint creates an ENI, you can apply security group rules to control which resources can connect to that endpoint.
This is important in secure architectures where private workloads need controlled access to AWS APIs.
DNS Behavior
Interface endpoints commonly rely on DNS so that standard AWS service names resolve to the private endpoint address instead of the public service endpoint.
This allows applications to keep using normal AWS service DNS names while traffic is redirected privately through the VPC endpoint.
Gateway VPC Endpoints
A gateway endpoint is a different type of VPC endpoint. It does not create an ENI in your subnet.
Instead, it becomes a target in a route table.
Gateway endpoints support only:
- Amazon S3
- Amazon DynamoDB
This is one of the most important facts to memorize for the SAP-C02 exam.
Key Characteristics of Gateway Endpoints
Gateway endpoints:
- Support only Amazon S3 and DynamoDB
- Do not use ENIs
- Do not use security groups
- Require updates to route tables
- Use AWS-managed prefix lists in route tables
- Can use endpoint policies
- Provide private connectivity to S3 or DynamoDB from within the VPC
Route Table Requirement
Gateway endpoints require a route table entry.
The route table sends traffic destined for S3 or DynamoDB service prefixes to the gateway endpoint. AWS uses managed prefix lists so the route does not need to target a specific static IP range manually.
This is a key difference from interface endpoints.
Endpoint Policies
VPC endpoints can use endpoint policies to control access to the destination AWS service.
An endpoint policy is a JSON policy attached to the endpoint. It can define which actions, resources, principals, or conditions are allowed through that endpoint.
For example, with an S3 gateway endpoint, you could create a policy that only allows access to specific S3 buckets.
Endpoint policies are useful because they provide another layer of control in addition to:
- IAM policies
- Bucket policies
- Security groups, for interface endpoints
- Network ACLs
- Route tables
Interface Endpoint vs Gateway Endpoint
The most important exam comparison is the difference between interface and gateway endpoints.
| Feature | Interface Endpoint | Gateway Endpoint |
|---|---|---|
| Supported services | Many AWS services | Amazon S3 and DynamoDB only |
| Underlying mechanism | Elastic Network Interface | Route table target |
| Uses private IPs | Yes | Yes, through service routing |
| Uses security groups | Yes | No |
| Requires route table update | Not in the same way; DNS/private IP routing is used | Yes |
| Uses DNS redirection | Yes | No, route table prefix lists are used |
| Uses prefix lists | Not the main mechanism | Yes |
| Endpoint policies | Yes | Yes |
| Common use case | Private access to AWS APIs and supported services | Private access to S3 or DynamoDB from a VPC |
Why VPC Endpoints Matter in Private Subnet Designs
Private subnets are often designed without direct internet access. If an EC2 instance in a private subnet needs to reach AWS services, the default answer might be to use a NAT gateway.
However, VPC endpoints may be a better answer when the destination is a supported AWS service.
For example:
- A private EC2 instance writing logs to an AWS service may use an interface endpoint.
- A private application reading objects from S3 may use a gateway endpoint.
- A private workload accessing DynamoDB may use a gateway endpoint.
- A private instance calling AWS APIs may use interface endpoints.
This can improve security and reduce dependency on internet egress paths.
NAT Gateway vs VPC Endpoint
A NAT gateway allows instances in private subnets to initiate outbound internet access. It is useful when private resources need to reach external internet destinations or AWS public endpoints without having public IP addresses.
A VPC endpoint is more specific. It provides private access to supported AWS services.
Use a NAT gateway when the instance needs general outbound internet access.
Use a VPC endpoint when the instance needs private access to a supported AWS service.
Security Considerations
VPC endpoints help reduce public internet exposure, but they do not automatically make access secure by themselves.
You still need to design proper controls.
Important security layers include:
- IAM permissions
- Endpoint policies
- S3 bucket policies
- DynamoDB permissions
- Security groups for interface endpoints
- Route table design
- Least privilege access
- Logging and monitoring
For S3, a strong design may combine:
- S3 gateway endpoint
- Endpoint policy
- S3 bucket policy restricting access to the endpoint
- IAM least privilege permissions
Operational Considerations
When deploying VPC endpoints, consider:
- Which subnets need access
- Which route tables must be updated
- Whether private DNS should be enabled
- Whether security groups allow the correct traffic
- Whether endpoint policies are too broad or too restrictive
- Whether application DNS resolution works as expected
- Whether workloads still require NAT for non-AWS destinations
A common real-world mistake is assuming that adding a VPC endpoint removes the need for a NAT gateway entirely. That is only true if all required outbound destinations are supported through endpoints.
Exam-Relevant Takeaways
For the SAP-C02 exam, remember these points:
- VPC endpoints allow private connectivity from a VPC to supported AWS services.
- They help avoid routing traffic over the internet.
- There are two main types: interface endpoints and gateway endpoints.
- Interface endpoints use ENIs with private IP addresses.
- Interface endpoints can use security groups.
- Interface endpoints support many AWS services.
- Interface endpoints use DNS to direct traffic to the private endpoint.
- Gateway endpoints support only Amazon S3 and DynamoDB.
- Gateway endpoints require route table updates.
- Gateway endpoints use AWS-managed prefix lists.
- Gateway endpoints do not use security groups.
- Endpoint policies can restrict what actions and resources are accessible through the endpoint.
- VPC endpoints can reduce the need for NAT gateways when accessing supported AWS services.
- NAT gateways are still required for general outbound internet access from private subnets.
Architecture Decision Guide
| Scenario | Best AWS Choice | Why |
|---|---|---|
| Private EC2 instance needs to access Amazon S3 without internet routing | S3 Gateway Endpoint | Gateway endpoints are designed for private S3 access and require route table updates. |
| Private EC2 instance needs to access DynamoDB privately | DynamoDB Gateway Endpoint | DynamoDB is one of the two services supported by gateway endpoints. |
| Private EC2 instance needs to call supported AWS service APIs privately | Interface Endpoint | Interface endpoints support many AWS services through PrivateLink and ENIs. |
| Need security group control on the endpoint | Interface Endpoint | Interface endpoints create ENIs and support security groups. |
| Need route-table-based private access to S3 | Gateway Endpoint | Gateway endpoints are added as route table targets using prefix lists. |
| Private subnet needs general access to public websites | NAT Gateway | VPC endpoints only support specific AWS services, not the entire internet. |
| Need to restrict S3 access through a specific private path | Gateway Endpoint with Endpoint Policy and Bucket Policy | This can enforce private access through the endpoint and limit allowed buckets/actions. |
| Application should keep using normal AWS service DNS names while routing privately | Interface Endpoint with Private DNS | Private DNS can redirect standard service names to the private endpoint. |
Common Exam Traps
Trap 1: Assuming All VPC Endpoints Work the Same Way
Interface endpoints and gateway endpoints are not interchangeable.
Interface endpoints use ENIs and security groups.
Gateway endpoints use route tables and support only S3 and DynamoDB.
Trap 2: Choosing a Gateway Endpoint for Any AWS Service
Gateway endpoints only support:
- Amazon S3
- Amazon DynamoDB
For most other AWS services, use an interface endpoint.
Trap 3: Thinking Gateway Endpoints Use Security Groups
Gateway endpoints do not use security groups.
Security group control applies to interface endpoints because they create ENIs.
Trap 4: Forgetting Route Table Updates for Gateway Endpoints
Gateway endpoints require route table updates.
If the route table associated with a subnet is not updated, resources in that subnet may not use the gateway endpoint.
Trap 5: Assuming a VPC Endpoint Replaces NAT for Everything
A VPC endpoint only helps with supported AWS services.
If a workload still needs access to external websites, package repositories, third-party APIs, or unsupported public endpoints, a NAT gateway or another egress design may still be required.
Trap 6: Ignoring Endpoint Policies
Endpoint policies can restrict access through the endpoint.
On the exam, a secure design may require more than simply creating the endpoint. You may also need endpoint policies, IAM policies, and resource policies.
Real-World Engineer Notes
In real environments, VPC endpoints are extremely useful for reducing unnecessary internet dependency.
For example, a private application server may need to access S3 for configuration files, backups, logs, or application assets. Without an endpoint, that traffic may go through a NAT gateway. With an S3 gateway endpoint, the server can reach S3 privately through the AWS network.
From an operations perspective, VPC endpoints can simplify security reviews because you can show that specific AWS service traffic does not require public internet routing.
However, endpoint design still needs planning.
Important real-world checks include:
- Confirm which AWS services the application actually uses.
- Identify whether each service supports interface endpoints or gateway endpoints.
- Make sure route tables are associated with the correct private subnets.
- Validate DNS behavior for interface endpoints.
- Confirm security groups allow traffic to interface endpoint ENIs.
- Use endpoint policies to prevent overly broad access.
- Check whether workloads still need NAT for operating system updates, third-party APIs, or external repositories.
- Monitor cost, especially when deploying many interface endpoints across multiple Availability Zones.
For enterprise environments, VPC endpoints are also useful for governance. They allow teams to create controlled private paths to AWS services instead of allowing broad outbound internet access from every workload subnet.
Quick Reference Summary
VPC endpoints provide private access from a VPC to supported AWS services.
There are two key types:
Interface Endpoint
- Uses ENIs
- Has private IP addresses
- Supports many AWS services
- Uses DNS redirection
- Supports security groups
- Supports endpoint policies
Gateway Endpoint
- Supports only S3 and DynamoDB
- Requires route table updates
- Uses prefix lists
- Does not use security groups
- Supports endpoint policies
For the exam, memorize the difference between interface endpoints and gateway endpoints. If the scenario mentions S3 or DynamoDB, consider a gateway endpoint. If the scenario mentions private access to many other AWS services, consider an interface endpoint.
Flashcards
Q: What is the purpose of a VPC endpoint?
A: A VPC endpoint allows resources in a VPC to privately access supported AWS services without routing traffic over the public internet.
Q: What are the two main types of VPC endpoints?
A: Interface endpoints and gateway endpoints.
Q: Which VPC endpoint type uses an Elastic Network Interface?
A: Interface endpoint.
Q: Which VPC endpoint type supports security groups?
A: Interface endpoint.
Q: Which AWS services are supported by gateway endpoints?
A: Amazon S3 and Amazon DynamoDB.
Q: Which VPC endpoint type requires route table updates?
A: Gateway endpoint.
Q: What mechanism do gateway endpoints use in route tables?
A: AWS-managed prefix lists.
Q: Which VPC endpoint type uses DNS to redirect service traffic privately?
A: Interface endpoint.
Q: Can a gateway endpoint use security groups?
A: No. Gateway endpoints do not use security groups.
Q: What policy type can be attached to a VPC endpoint to restrict access?
A: An endpoint policy.
Q: When should you use a NAT gateway instead of a VPC endpoint?
A: When private subnet resources need general outbound internet access or access to destinations not supported by VPC endpoints.
Q: Why might an S3 gateway endpoint be preferred over NAT gateway access to S3?
A: It keeps S3 traffic private and avoids routing that traffic through the NAT gateway.
Q: What is the main exam trap with gateway endpoints?
A: Thinking they support many AWS services. They only support S3 and DynamoDB.
Q: What is the main exam trap with interface endpoints?
A: Forgetting that they create ENIs and can be controlled with security groups.
Q: Do VPC endpoints automatically remove the need for NAT gateways?
A: No. They only provide private access to supported AWS services.
Practice Questions
Question 1:
A company has EC2 instances in a private subnet that need to access Amazon S3 without sending traffic through a NAT gateway or the public internet. Which solution should the architect recommend?
A. Create an internet gateway and assign public IPs to the instances
B. Create an S3 gateway VPC endpoint and update the private subnet route table
C. Create a NAT gateway in the private subnet
D. Create a VPC peering connection to the S3 service VPC
Correct Answer:
B. Create an S3 gateway VPC endpoint and update the private subnet route table
Explanation:
Gateway endpoints support Amazon S3 and DynamoDB. For S3 access from private subnets, an S3 gateway endpoint allows private connectivity and requires route table updates.
Question 2:
A private EC2 instance needs to call a supported AWS service API privately. The security team wants to control access to the endpoint using security groups. Which endpoint type should be used?
A. Gateway endpoint
B. Interface endpoint
C. Internet gateway
D. NAT instance
Correct Answer:
B. Interface endpoint
Explanation:
Interface endpoints create ENIs in the VPC and can have security groups attached. Gateway endpoints do not support security groups.
Question 3:
Which statement correctly describes gateway VPC endpoints?
A. They support all AWS services and use ENIs
B. They support S3 and DynamoDB and require route table entries
C. They require security groups and private DNS
D. They are used for inbound internet access to private subnets
Correct Answer:
B. They support S3 and DynamoDB and require route table entries
Explanation:
Gateway endpoints support only Amazon S3 and DynamoDB. They are configured as route table targets and use prefix lists for routing.
Question 4:
An architect creates a gateway endpoint for Amazon S3 but instances in one private subnet still access S3 through the NAT gateway. What is the most likely issue?
A. The endpoint needs a security group
B. The subnet’s route table was not associated with the gateway endpoint route
C. Interface endpoints are required for S3
D. The EC2 instances need public IP addresses
Correct Answer:
B. The subnet’s route table was not associated with the gateway endpoint route
Explanation:
Gateway endpoints require route table updates. If the subnet’s route table does not include the gateway endpoint route, traffic may continue using the NAT gateway or fail depending on the route design.
Question 5:
A workload in a private subnet needs to access both Amazon S3 and external third-party APIs on the internet. Which design is most appropriate?
A. Use only an S3 gateway endpoint
B. Use only an interface endpoint
C. Use an S3 gateway endpoint for S3 and a NAT gateway for third-party internet access
D. Use a VPC peering connection for all outbound traffic
Correct Answer:
C. Use an S3 gateway endpoint for S3 and a NAT gateway for third-party internet access
Explanation:
The S3 gateway endpoint handles private S3 access, but VPC endpoints do not provide general internet access. A NAT gateway is still needed for outbound access to third-party public endpoints.