Study guide
Technical reference and lesson notes
Purpose of This Lesson
VPC endpoints provide private connectivity from resources in a VPC to supported AWS services without sending traffic through the public internet. They are especially useful when instances in private subnets need to access services such as Amazon S3, Amazon DynamoDB, or AWS APIs without relying on a NAT gateway or internet gateway path.
The two endpoint categories tested most often are:
- Interface endpoints, which use elastic network interfaces and support many AWS services.
- Gateway endpoints, which use route tables and support only Amazon S3 and Amazon DynamoDB.
Understanding how these endpoint types differ is important for service selection, security design, routing, and cost optimization.
Key Concepts
Why Use a VPC Endpoint?
Without a VPC endpoint, a workload in a private subnet may need to reach a public AWS service endpoint through a path such as:
- The workload sends traffic to a NAT gateway.
- The NAT gateway uses an internet gateway to reach the public AWS service endpoint.
- The response returns through the NAT gateway to the private subnet.
A VPC endpoint creates a private path instead. This can reduce exposure to the public internet and, depending on the endpoint type and design, eliminate NAT gateway processing charges for supported service traffic.
VPC endpoints do not generally provide private connectivity to arbitrary internet destinations. They provide private access to supported AWS services and, for some interface endpoints, endpoint services published through AWS PrivateLink.
Interface VPC Endpoints
An interface endpoint is powered by AWS PrivateLink. AWS creates an elastic network interface (ENI) in the selected subnet. The ENI receives private IP addresses, and applications connect to the endpoint through those private addresses.
Important characteristics:
- Supports many AWS services and AWS API endpoints.
- Uses one or more ENIs in selected subnets.
- Can be associated with security groups.
- Uses private DNS names when private DNS is enabled and supported.
- Requires appropriate subnet, security group, and DNS configuration.
- Typically should be deployed in each Availability Zone from which workloads access it to improve availability and avoid cross-AZ data transfer.
For an interface endpoint, the workload generally sends traffic to the endpoint ENI. Security groups on the endpoint control inbound traffic to that ENI, while the workload’s own security group controls its outbound traffic.
Gateway VPC Endpoints
A gateway endpoint is a VPC route target for supported AWS services. It does not create an ENI in the subnet.
Gateway endpoints support only:
- Amazon S3
- Amazon DynamoDB
To use one, associate the endpoint with the relevant route tables. AWS adds a route using a service prefix list as the destination. Traffic matching that prefix list is sent to the gateway endpoint rather than to a NAT gateway or internet gateway.
Important characteristics:
- Uses route tables rather than ENIs.
- Supports only S3 and DynamoDB.
- Does not use security groups on the endpoint.
- Has no hourly endpoint charge, although normal service and data-transfer charges may still apply.
- Can be restricted with an endpoint policy.
Endpoint Policies
An endpoint policy is a resource-based JSON policy that controls which requests may pass through the endpoint. It can be used as an additional layer of authorization, but it does not replace IAM policies, S3 bucket policies, or other service-specific permissions.
A request generally needs to satisfy all applicable controls, such as:
- The identity-based IAM policy.
- The endpoint policy, when applicable.
- The resource policy, such as an S3 bucket policy.
- Network controls, including security groups and network ACLs where relevant.
Endpoint policies are particularly useful when administrators want to limit which S3 buckets, DynamoDB resources, or API actions can be accessed through a VPC endpoint.
Exam-Relevant Takeaways
- Gateway endpoints support only S3 and DynamoDB. This is one of the most important memorization points.
- Interface endpoints use ENIs and private IP addresses. They support many AWS services and can use security groups.
- Gateway endpoints require route table association. Their routes use AWS-managed service prefix lists.
- Gateway endpoints do not use security groups because they are route-table targets rather than network interfaces.
- Interface endpoints are zonal resources. For highly available workloads, deploy endpoint ENIs in the Availability Zones where the workloads run.
- Private DNS matters for interface endpoints. It allows standard AWS service hostnames to resolve to private endpoint IP addresses when configured appropriately.
- Endpoint policies are not a replacement for IAM. They provide an additional restriction layer.
- A VPC endpoint avoids the need for a NAT gateway for traffic to the supported service, but it does not automatically make every workload connection private. Correct DNS, route tables, security groups, and policies still matter.
Architecture Decision Guide
| Requirement | Recommended option | Reason |
|---|---|---|
| Private access from a VPC to Amazon S3 | Gateway endpoint, unless a specific interface endpoint design is required | Purpose-built option using route tables and no endpoint hourly charge |
| Private access from a VPC to DynamoDB | Gateway endpoint | Gateway endpoints support DynamoDB |
| Private access to AWS services such as Systems Manager, Kinesis, or Secrets Manager | Interface endpoint | These services use interface endpoints |
| Need security groups attached to the endpoint | Interface endpoint | The endpoint is represented by ENIs |
| Need to restrict traffic using a route-table target and prefix list | Gateway endpoint | Gateway endpoint routes target the service prefix list |
| Need private access to an endpoint service published by another organization | Interface endpoint | AWS PrivateLink endpoint services use interface endpoints |
| Workloads run in multiple Availability Zones | Interface endpoints in the required AZs | Provides zonal resilience and can avoid unnecessary cross-AZ traffic |
| Private subnet needs S3 access without a NAT gateway | Gateway endpoint | The S3 prefix-list route sends traffic privately through the VPC endpoint |
Common Exam Traps
Confusing Service Coverage
Do not assume every AWS service uses a gateway endpoint. Gateway endpoints support only S3 and DynamoDB. Most other AWS service API integrations that use VPC endpoints require interface endpoints.
Assuming an Interface Endpoint Uses a Route Table Target
An interface endpoint is reached through ENI IP addresses and DNS resolution. It is not configured like a gateway endpoint with a prefix-list route as the primary mechanism.
Assuming Gateway Endpoints Have Security Groups
Gateway endpoints do not create ENIs, so there is no endpoint network interface to which a security group can be attached. Route tables and endpoint policies are the relevant controls.
Forgetting Route Table Association
Creating a gateway endpoint is not sufficient. The endpoint must be associated with the route tables used by the subnets that need access.
Deploying One Interface Endpoint in Only One AZ
An interface endpoint in one AZ may become a dependency for workloads in other AZs. For resilient, multi-AZ architectures, create endpoint ENIs in the required AZs and ensure DNS and security group rules permit access.
Treating Endpoint Policies as Complete Authorization
An endpoint policy cannot grant permissions that IAM or the target service’s resource policy denies. It is an additional restriction, not a substitute for the complete authorization model.
Believing VPC Endpoints Provide General Internet Access
VPC endpoints provide private access to supported AWS services or PrivateLink endpoint services. They are not a replacement for an internet gateway, NAT gateway, or proxy when workloads must access arbitrary public internet destinations.
Real-World Engineer Notes
- For an S3 or DynamoDB access pattern from private subnets, start with a gateway endpoint. It is usually simpler and avoids NAT gateway dependency and endpoint hourly costs.
- Use interface endpoints when the target service requires them, such as AWS Systems Manager API endpoints or Secrets Manager.
- Place interface endpoint ENIs in the Availability Zones that host dependent workloads. Confirm the endpoint subnet has enough IP address capacity.
- Apply a least-privilege security group to interface endpoints. Permit inbound traffic only from the workload security groups and required service ports, typically HTTPS on TCP 443.
- Enable and validate private DNS for interface endpoints when applications use standard AWS service DNS names. If private DNS is disabled, applications may need to use endpoint-specific DNS names.
- Review endpoint policies alongside IAM and resource policies. A restrictive endpoint policy can cause access failures even when the IAM policy appears correct.
- Use VPC Flow Logs, DNS query logging, and service-specific audit logs to troubleshoot connectivity and authorization problems.
- Check the actual service endpoint support and regional availability before finalizing the design. Not every AWS API or feature is available through every endpoint type in every Region.
Quick Reference Summary
| Feature | Interface endpoint | Gateway endpoint |
|---|---|---|
| Underlying mechanism | ENI with private IP addresses | Route-table target |
| AWS technology | AWS PrivateLink | VPC gateway endpoint |
| Supported services | Many AWS services and supported PrivateLink endpoint services | S3 and DynamoDB only |
| Security groups | Yes | No |
| Route-table update | Not the defining configuration mechanism | Required |
| DNS | Commonly uses private DNS | Uses service routing through prefix-list routes |
| Endpoint policy | Supported where applicable | Supported |
| Availability design | Deploy ENIs in required AZs | Associate with required route tables |
| Main exam clue | “ENI,” “private IP,” “security group,” or “many services” | “S3/DynamoDB,” “route table,” or “prefix list” |
Flashcards
- Q: What is the main purpose of a VPC endpoint?
A: To provide private connectivity from a VPC to supported AWS services without routing traffic through the public internet.
- Q: Which AWS services support gateway VPC endpoints?
A: Amazon S3 and Amazon DynamoDB only.
- Q: What resource represents an interface VPC endpoint inside a subnet?
A: An elastic network interface with private IP addresses.
- Q: Which VPC endpoint type can use security groups?
A: Interface endpoints.
- Q: What must be updated when configuring a gateway endpoint?
A: The route tables associated with the subnets that need access.
- Q: What destination appears in a gateway endpoint route?
A: A service prefix list for S3 or DynamoDB.
- Q: Does a gateway endpoint create an ENI?
A: No. It is a route-table target.
- Q: What is the role of an interface endpoint’s private DNS setting?
A: It allows standard AWS service DNS names to resolve to private endpoint IP addresses when supported and enabled.
- Q: Are endpoint policies a replacement for IAM policies?
A: No. Endpoint policies add restrictions; IAM and resource policies still apply.
- Q: How should interface endpoints usually be deployed for a multi-AZ workload?
A: Deploy endpoint ENIs in the Availability Zones used by the workload to improve resilience and reduce unnecessary cross-AZ traffic.
Practice Questions
Question 1
A company runs EC2 instances in private subnets and needs to upload objects to Amazon S3. Security requirements prohibit routing the traffic through a NAT gateway. Which solution is simplest and most cost-effective?
A. Create an interface endpoint for S3 in one subnet and attach a security group.
B. Create a gateway endpoint for S3 and associate it with the private subnets’ route tables.
C. Add an internet gateway route to each private subnet.
D. Create a NAT gateway in each Availability Zone.
Correct answer: B
A gateway endpoint provides private S3 connectivity through route tables and avoids the need for a NAT gateway. Gateway endpoints do not use security groups or ENIs.
Question 2
An application in private subnets must call AWS Secrets Manager without using public IP addresses. The design must restrict endpoint access to a specific application security group. Which solution meets the requirements?
A. Create a gateway endpoint and add a route to the Secrets Manager prefix list.
B. Create an interface endpoint for Secrets Manager and configure its security group to allow HTTPS from the application security group.
C. Use an S3 gateway endpoint and configure an S3 bucket policy.
D. Route the traffic through an internet gateway.
Correct answer: B
Secrets Manager uses an interface endpoint. Interface endpoints create ENIs and support security groups, allowing access to be restricted to designated workloads.
Question 3
A VPC contains private subnets in three Availability Zones. The application uses AWS Systems Manager APIs through an interface endpoint. The architect wants to avoid a single-AZ dependency. What should the architect do?
A. Create one interface endpoint in the VPC and associate it with all route tables.
B. Create interface endpoint ENIs in the required Availability Zones and configure security groups and private DNS correctly.
C. Replace the interface endpoint with a gateway endpoint.
D. Add an internet gateway to each private subnet.
Correct answer: B
Interface endpoints are zonal because they use ENIs in selected subnets. Deploying them in the required AZs improves availability and avoids relying on a cross-AZ endpoint path.
Question 4
An administrator creates an S3 gateway endpoint but EC2 instances in a private subnet still send S3 traffic to the NAT gateway. What is the most likely cause?
A. The endpoint requires a security group.
B. The endpoint must be converted to an interface endpoint.
C. The private subnet’s route table is not associated with the gateway endpoint.
D. S3 does not support VPC endpoints.
Correct answer: C
Gateway endpoints work through route tables. The route table used by the private subnet must be associated with the endpoint so traffic to the S3 prefix list is directed to it.
Question 5
A workload has an IAM policy allowing access to an S3 bucket, but requests through the VPC gateway endpoint are denied. The endpoint policy allows access only to a different bucket. What explains the denial?
A. Gateway endpoints cannot access S3.
B. The endpoint policy provides an additional restriction and does not allow the requested bucket.
C. S3 requires an internet gateway for all VPC access.
D. Security groups always override endpoint policies.
Correct answer: B
The effective authorization decision must satisfy all applicable policies. An IAM allow does not override a restrictive endpoint policy.