Visual overview
PrivateLink interface endpoints provide private service entry points without broad VPC-to-VPC routing.
Technical reference
Endpoint type changes packet mechanics and scope.
A route-table target for those services; it does not use AWS PrivateLink.
Creates endpoint network interfaces in selected subnets and uses PrivateLink.
Supported service names can resolve to interface-endpoint private addresses when private DNS is enabled.
Supported endpoint traffic does not need an IGW or NAT device for that destination.
Private service access without traversing the public internet
A VPC endpoint lets resources in a VPC reach supported AWS services or endpoint services using private connectivity without requiring an internet gateway or NAT device for that service path. This can reduce public exposure and simplify architectures in which workloads should remain on private addressing. Endpoint type matters because gateway and interface endpoints have different network mechanics, supported targets and pricing models.
An endpoint does not bypass authorization. The caller still needs the service-level permissions required for the requested API operation, and endpoint policies can add another authorization boundary where supported. Route tables, security groups and DNS behavior also differ by endpoint type, so 'we created an endpoint' is not sufficient troubleshooting evidence by itself.
Gateway endpoints: S3 and DynamoDB through routing
Gateway endpoints provide private access to Amazon S3 and DynamoDB from a VPC. You select route tables, and AWS adds service prefix-list routes whose target is the gateway endpoint. Traffic matching those service destinations takes the endpoint route rather than requiring an internet or NAT path. AWS documents no additional charge for gateway endpoints themselves, making them an important architectural option for private S3/DynamoDB traffic.
Gateway endpoints have scope limitations. For example, S3 gateway endpoint access is designed for resources whose traffic can use the associated VPC route table; accessing privately from on-premises networks, peered VPCs or some transit patterns can require an interface endpoint instead. The architecture should choose the endpoint type from the location of clients and service support, not simply from cost.
Interface endpoints and AWS PrivateLink
An interface endpoint creates endpoint network interfaces with private IP addresses in selected subnets. These private addresses become entry points for a supported AWS service or endpoint service through AWS PrivateLink. Security groups control network access to the endpoint interfaces, and private DNS can make supported Regional service names resolve to the private endpoint from the VPC when configured appropriately.
PrivateLink is also used to privately expose services across VPC boundaries without creating broad routed connectivity between the VPC address spaces. That distinction is powerful: the consumer connects to a specific service endpoint rather than receiving general network reachability to every address in the provider VPC. Interface endpoints have endpoint-hour and data-processing pricing dimensions, so the security and topology benefit should be evaluated alongside cost.
Key takeaways
- 01
VPC endpoints create private service paths that do not require NAT or an internet gateway for that supported destination.
- 02
Gateway endpoints serve S3 and DynamoDB using route-table entries and do not use AWS PrivateLink.
- 03
Interface endpoints use private IP network interfaces and AWS PrivateLink; security groups and private DNS are important controls.
- 04
PrivateLink can expose a specific service privately without providing general routed connectivity between VPCs.
Official AWS sources
Use these primary AWS resources for the source material behind this article and for deeper reference.