VPC Endpoints & PrivateLink

Two Endpoint Types

VPC endpoints keep AWS service traffic off the public internet. Gateway endpoints (S3 and DynamoDB) are route-table targets: add a route, zero hourly cost, reachable only from within the VPC — the workhorse for S3 access from private subnets without a NAT box.

Interface endpoints are ENIs with private DNS names in your subnets, billed hourly per AZ plus data processed, and available for most AWS services plus anything exposed via PrivateLink: the provider puts their service behind a Network Load Balancer, creates an endpoint service, and consumers create interface endpoints to it — traffic never traverses the public internet, and the provider never sees the consumer's VPC.

Creating and Securing Endpoints

aws ec2 create-vpc-endpoint --vpc-id vpc-abc \
  --service-name com.amazonaws.us-east-1.s3 \
  --route-table-ids rtb-123

aws ec2 create-vpc-endpoint --vpc-id vpc-abc \
  --vpc-endpoint-type Interface \
  --service-name com.amazonaws.us-east-1.secretsmanager \
  --subnet-ids subnet-1 subnet-2 \
  --security-group-ids sg-endpoint

An endpoint policy is an additional IAM-style resource policy on the connection (e.g., deny unless aws:sourceVpce matches). On the provider side, allow or deny specific AWS principals per endpoint. The SG attached to the endpoint ENIs must allow inbound 443 from the client subnets/CIDR.

Pitfalls and Interview Focus

DNS is the usual culprit: private DNS only works when the VPC has DNS resolution and DNS hostnames enabled; otherwise the public IP still resolves. Security groups are evaluated on both the client and the endpoint ENI — a correct client SG with a missing inbound rule on the endpoint yields timeouts.

S3 bucket policies can pin access with aws:sourceVpce, which breaks scripts that suddenly run from outside. Gateway endpoints apply only in their region and do not cover other services (NAT remains for those). Interface endpoints cost money per AZ, so use them where NAT egress or internet isolation matters.

Interview: contrast gateway (free, route-based, S3/DynamoDB) with interface (ENI, private DNS, hourly) and place PrivateLink as the cross-account service-sharing layer.