All 7 VPC & Networking questions
More in VPC & Networking
What is the difference between a public subnet and a private subnet within a VPC? How do security groups and network ACLs differ in how they control traffic to and from resources within a VPC? How does a NAT Gateway allow resources in a private subnet to access the internet for outbound connections while remaining unreachable from inbound internet traffic? How does VPC Peering enable private network communication between two separate VPCs, and what are its limitations? How should an organization design a scalable, secure VPC architecture that supports multiple accounts, hybrid connectivity, and future growth?
Advertisement
AWS › VPC & Networking

How do VPC endpoints, including gateway and interface endpoints, allow private connectivity to AWS services without traversing the public internet?

Advanced

Answer

A VPC endpoint lets resources within your VPC connect privately to supported AWS services, such as S3 or DynamoDB using a gateway endpoint, or many other services using an interface endpoint backed by a private IP address within your VPC, meaning traffic to these services never needs to leave the AWS network or traverse the public internet through an internet gateway or NAT Gateway, both improving security and often reducing data transfer costs.
aws ec2 create-vpc-endpoint --vpc-id vpc-12345 --service-name com.amazonaws.us-east-1.s3 --route-table-ids rtb-12345
Real-world example A company running sensitive workloads in a private subnet with no internet access at all still allows those workloads to securely access S3 and Secrets Manager by configuring VPC endpoints for both services, entirely avoiding any need for internet connectivity.

Common follow-ups: What is the difference between a gateway endpoint and an interface endpoint?;Do VPC endpoints incur an hourly cost in addition to standard data transfer charges?

S3 & Storage;AWS Secrets Manager & Parameter Store
All 7 VPC & Networking questions