All Posts
2024-10-25Hünkar Döner

AWS VPC Endpoints: Gateway vs Interface Explained

AWSVPCNetworkingSecurityCloud
A

AWS VPC Endpoints: Gateway vs Interface Explained

VPC Endpoints are crucial for building a secure and efficient network architecture in the AWS cloud. In this guide, we will explore the types of VPC Endpoints, the differences between Gateway and Interface Endpoints, and how to set them up.

<div class="toc"> <ul> <li><a href="#what-are-vpc-endpoints">What are VPC Endpoints?</a></li> <li><a href="#gateway-endpoints">Gateway Endpoints</a></li> <li><a href="#interface-endpoints">Interface Endpoints (PrivateLink)</a></li> <li><a href="#comparison-and-benefits">Comparison and Benefits</a></li> <li><a href="#step-by-step-setup">Step-by-Step Setup</a></li> <li><a href="#faq">FAQ</a></li> </ul> </div>

What are VPC Endpoints?

A VPC Endpoint enables you to privately connect your VPC to supported AWS services. The most significant feature is that traffic remains entirely within the AWS network, without traversing the public internet. This reduces both security risks and data transfer costs.

There are two main types of VPC Endpoints:

  1. Gateway Endpoints
  2. Interface Endpoints

Gateway Endpoints

Gateway Endpoints are used as a target in your VPC route table for traffic destined for specific AWS services (currently only Amazon S3 and Amazon DynamoDB).

  • Free: There is no additional charge for using them.
  • No Internet Gateway Required: Provides access without public IP addresses.
  • No PrivateLink: Unlike interface endpoints, they do not use PrivateLink technology.

For example, an EC2 instance in a private subnet can access S3 directly without needing a NAT Gateway.

Interface Endpoints (PrivateLink)

Interface Endpoints use AWS PrivateLink technology to provide access to services via private IP addresses. An Interface Endpoint serves as an Elastic Network Interface (ENI) with a private IP address in a subnet of your VPC.

  • Paid: Billed per hour and per GB of data processed.
  • Broad Support: Supports Amazon S3, EC2, SNS, Kinesis, and many other AWS services.
  • Flexibility: Can be accessed from on-premise networks or other VPCs.

Comparison and Benefits

FeatureGateway EndpointInterface Endpoint
Supported ServicesS3, DynamoDBMost AWS Services
CostFreeHourly + Data Processing Fee
TechnologyRoute Table (Prefix List)PrivateLink (ENI)
AccessFrom within VPC onlyVPC, VPN, Direct Connect

Benefits

  • Security: Traffic never leaves the AWS network.
  • Cost Savings: Avoid NAT Gateway data processing charges (especially for S3).
  • Performance: Lower latency via the optimized AWS network.

Step-by-Step Setup

Gateway Endpoint Setup (Example)

  1. Navigate to the VPC service in the AWS Console.
  2. Select Endpoints from the left menu and click Create endpoint.
  3. Under Service category, select AWS services.
  4. Search for s3 and select com.amazonaws.[region].s3 (Type: Gateway).
  5. Select your VPC.
  6. In the Route tables section, select the route tables that should use this endpoint. AWS will automatically add a route (prefix list) for S3 to these tables.
  7. Define access permissions in the Policy section (Default: Full Access).
  8. Click Create endpoint to finish.

FAQ

<div itemscope itemtype="https://schema.org/FAQPage"> <div itemscope itemprop="mainEntity" itemtype="https://schema.org/Question"> <h3 itemprop="name">What is the cost of using VPC Endpoints?</h3> <div itemscope itemprop="acceptedAnswer" itemtype="https://schema.org/Answer"> <div itemprop="text"> Gateway Endpoints (for S3 and DynamoDB) are free. Interface Endpoints are billed hourly per endpoint created and per GB of data processed. </div> </div> </div> <div itemscope itemprop="mainEntity" itemtype="https://schema.org/Question"> <h3 itemprop="name">When should I use Interface Endpoints?</h3> <div itemscope itemprop="acceptedAnswer" itemtype="https://schema.org/Answer"> <div itemprop="text"> You should use Interface Endpoints if you need private access to services other than S3 and DynamoDB (e.g., SNS, Kinesis) or if you need to access AWS services from your on-premise network (via VPN/Direct Connect). </div> </div> </div> <div itemscope itemprop="mainEntity" itemtype="https://schema.org/Question"> <h3 itemprop="name">Does accessing S3 via Gateway Endpoint require a NAT Gateway?</h3> <div itemscope itemprop="acceptedAnswer" itemtype="https://schema.org/Answer"> <div itemprop="text"> No, when using a Gateway Endpoint, traffic flows directly over the AWS network; neither a NAT Gateway nor an Internet Gateway is required. </div> </div> </div> </div> <br> <hr> <p><em>Kaynak / Source: https://awsfundamentals.com/blog/vpc-endpoints</em></p>