Networking
VPC endpoints and PrivateLink: keep traffic off the public internet
This issue covers VPC endpoints and AWS PrivateLink, the feature behind "our traffic never touches the public internet."
Why this matters
By default, a workload in a VPC reaches Amazon S3, an AWS API, or a partner SaaS over a public path: through an internet gateway or a NAT gateway, out to a public endpoint, and back. For regulated Commonwealth data (CJIS, IRS 1075, tax and court records), that public hop is often the exact thing a security review will not sign off on. VPC endpoints remove it. They place a private door to the service inside your VPC, so the traffic stays on the AWS network with no internet gateway, NAT, VPN, or Direct Connect in the path.
There is a cost angle too. NAT gateways bill an hourly charge plus a per-GB data-processing charge on everything that flows through them. Moving S3 and DynamoDB traffic onto a free gateway endpoint, and other AWS-service traffic onto interface endpoints, takes that volume off the NAT bill. AWS calls this out in its own NAT pricing guidance.
Rule of thumb: match the endpoint to what you are reaching. An AWS service, a partner service, or a specific private resource each has its own endpoint type.
Quick context
- A VPC endpoint gives your VPC a private route to a service or resource, so traffic stays on the AWS network.
- There are now three endpoint types, not two. The old "gateway for S3 and DynamoDB, interface for everything else" model is no longer the whole picture.
- Endpoint policies (resource policies on the endpoint) let you restrict exactly what can be reached through it.
- Private DNS lets an interface endpoint take over the service's normal DNS name, so existing SDKs and clients work unchanged.
Gateway endpoints
- Cover Amazon S3 and Amazon DynamoDB only.
- No hourly or data-processing charge. This is the free quick win.
- Implemented as a route in your route table (a prefix list), not a network card, so there is no private IP to manage.
- Local to the VPC. They do not extend to on-premises or peered VPCs.
Interface endpoints (AWS PrivateLink)
- A network card (ENI) with a private IP placed in your subnets.
- Cover most AWS services, plus partner and SaaS "endpoint services" published by a provider.
- Billed per hour for each Availability Zone, plus per GB of data processed. Cross-AZ data transfer through the endpoint is not charged.
- This is the workhorse for private access to AWS APIs and for reaching a vendor's service privately.
Resource endpoints (newer, GA at re:Invent 2024)
- Reach one specific resource, an Amazon RDS database, an EC2 instance, an IP address, or a domain-name target, that sits in another VPC or on-premises.
- You no longer have to stand up and run your own Network Load Balancer to publish that resource. A VPC Lattice resource gateway handles it.
- This closes the old gap: getting a private path to a database or an arbitrary IP target used to require building a PrivateLink service yourself.
What changed recently (worth knowing)
- Cross-Region PrivateLink. Endpoints used to be strictly regional. Native cross-Region connectivity to partner endpoint services launched in late 2024, and cross-Region connectivity to AWS services reached general availability in November 2025 (commercial partition, select services). You can now reach a service in another Region over a private IP in your VPC.
- Stronger network perimeters (2025). New global condition keys let you enforce a data perimeter from the resource side. aws:VpceAccount, aws:VpceOrgID, and aws:VpceOrgPaths (August 2025) require that a request arrives through a VPC endpoint owned by your account or AWS organization. aws:SourceVpcArn (November 2025) restricts access to endpoints in specific Regions, which supports data residency. You set these in your resource and identity policies, not in the endpoint policy itself.
When not to use it / tradeoffs
- Interface endpoints are not free. For a service you call rarely, the per-AZ hourly charge can cost more than the NAT path it replaces. Add them where traffic or security justifies it, not blanket across every service.
- Gateway endpoints stop at the VPC boundary. For centralized or hybrid access to S3 or DynamoDB from on-premises or many VPCs, you use interface endpoints instead.
- Public sector partition check. Cross-Region access to AWS services is commercial-partition and select-service today. For GovCloud or any Commonwealth workload, confirm the feature and Region availability before you design around it.
Quick decision guide
- Reaching S3 or DynamoDB? Start with a gateway endpoint. It is free and quick.
- Reaching another AWS service privately (Secrets Manager, KMS, RDS API, ECR, etc.)? Use an interface endpoint.
- Reaching a partner or SaaS product privately? Use an interface endpoint to their published endpoint service.
- Reaching a specific database, server, IP, or on-prem target? Use a resource endpoint and skip running your own load balancer.
- Reaching a service in another Region privately? Cross-Region PrivateLink, after you confirm the service and partition support it.
AWS references
- AWS PrivateLink concepts - docs.aws.amazon.com/vpc/latest/privatelink/concepts.html
- Access AWS services through interface endpoints - docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-aws-services.html
- Gateway endpoints (S3 and DynamoDB) - docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html
- Access VPC resources through resource endpoints - docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-resources.html
- Cross-Region connectivity to AWS services (What's New, Nov 2025) - aws.amazon.com/about-aws/whats-new/2025/11/aws-privatelink-cross-region-connectivity-aws-services
- VPC endpoint condition keys for network perimeters (What's New, Aug 2025) - aws.amazon.com/about-aws/whats-new/2025/08/aws-iam-new-vpc-endpoint-condition-keys/
- AWS PrivateLink pricing - aws.amazon.com/privatelink/pricing/
- Well-Architected, Security Pillar (infrastructure protection) - docs.aws.amazon.com/wellarchitected/latest/security-pillar/protecting-networks.html