What is a VPC endpoint and what is the difference between gateway and interface endpoints?
A VPC endpoint lets resources in your VPC reach AWS services privately without an internet gateway or NAT. Gateway endpoints, for S3 and DynamoDB, are route-table entries and free. Interface endpoints use PrivateLink with a network interface and are charged.
Explain it simply
Normally an instance in a private subnet reaches S3 by going out through the NAT gateway to the public internet and back. A VPC endpoint is a private corridor straight from your building to the S3 office, so the traffic never walks on the street.
Example
Gateway endpoint (S3, DynamoDB only)
Added as a target in the route table
Prefix list for S3 -> vpce-123
No hourly charge, no data processing charge
Not reachable from on-premises or other VPCs
Interface endpoint (PrivateLink)
Creates an elastic network interface with a private IP in your subnet
Supports many services: SQS, SNS, Secrets Manager, KMS, CloudWatch...
Also your own services shared through PrivateLink
Hourly charge plus per-GB charge
Reachable over VPN or Direct Connect
Endpoint policy: restricts what can be done through the endpointBenefits: no internet exposure, lower NAT cost for heavy S3 traffic, and tighter security by combining endpoint policies with bucket policies that allow only your endpoint.
What to say in the interview
"A VPC endpoint gives private access to AWS services without a NAT or internet gateway. Gateway endpoints cover S3 and DynamoDB through route tables at no charge. Interface endpoints use PrivateLink network interfaces for many other services and cost hourly plus per GB."
Common mistakes
- Assuming a gateway endpoint can be used from an on-premises network.