AWS Solutions Architect Associate · Trade-off

Gateway Endpoints vs Interface Endpoints: Private Access to AWS Services

A gateway endpoint is a free route table entry that sends traffic for Amazon S3 or Amazon DynamoDB privately from a VPC. An interface endpoint is a private IP address in your subnet, powered by AWS PrivateLink, that works for most AWS services and can be reached from on premises. Use a gateway endpoint for S3 or DynamoDB inside the VPC; use an interface endpoint for everything else.

Last updated October 2026.

The problem both solve

AWS service endpoints are public. Without a VPC endpoint, an instance in a private subnet reaches Amazon S3 or Amazon SQS through a NAT gateway and an internet gateway. A VPC endpoint gives it a direct path instead: traffic stays on the AWS network, with no internet gateway, NAT device or public IP needed.

Both types accept an endpoint policy, an IAM resource policy that narrows what can pass through the endpoint. It never grants access on its own: the caller's identity policy and any bucket policy still have to allow the request.

Gateway endpoints: a route, for two services

Only Amazon S3 and Amazon DynamoDB. No other service has a gateway endpoint.
A route table entry. Associating the endpoint adds a route whose destination is the service's AWS-managed prefix list. The most specific route wins, so S3 traffic leaves the NAT gateway path.
No charge. That is why it is the standard answer to "reduce NAT gateway data processing costs for S3".
Limited reach. It works only from the VPC it belongs to, in the same Region. It cannot be reached from on premises, a peered VPC or another Region.

Interface endpoints: a private IP, for most services

Most AWS services, including S3 and DynamoDB, plus partner services and your own services shared through AWS PrivateLink.
An elastic network interface per Availability Zone. You pick the subnets, one per AZ; choose two or more for availability.
A security group on the endpoint, so you control which sources may connect.
Private DNS. With it on, the normal service hostname resolves to the endpoint's private IPs, so SDK code needs no change.
Reachable from elsewhere. Because it is just a private IP, on-premises networks over AWS Direct Connect or Site-to-Site VPN, and other VPCs over peering or AWS Transit Gateway, can use it.
Billed per endpoint per AZ per hour, plus per GB processed.

Side by side

	Gateway	Interface
Services	S3 and DynamoDB only	Most AWS services, partner and your own
Mechanism	Route to a prefix list	Network interface with a private IP, per AZ
Reach	Its own VPC, same Region	Also on premises and other VPCs
Access control	Endpoint policy, route tables	Endpoint policy, security group
Cost	No charge	Hourly per AZ, plus per GB

From the AWS PrivateLink guide, checked 23 October 2026.

Signals that decide the question

Gateway endpoint

"S3 or DynamoDB", "from instances in the VPC", "cut NAT gateway costs", "lowest cost". Free and nothing to manage.

Interface endpoint

Any other service (SQS, KMS, Secrets Manager, ECR), "from on premises", "from another VPC", or "a security group must control access".

They also combine. A common pattern uses a free S3 gateway endpoint for traffic from inside the VPC and an S3 interface endpoint for on-premises clients. A trap answer offers a "gateway endpoint for SQS": it does not exist.

Lock both ends. To stop data leaving to an outside bucket, put an endpoint policy that allows only the company's buckets, and a bucket policy that denies requests unless aws:SourceVpce is your endpoint.

FAQ

What is the difference between a gateway endpoint and an interface endpoint?

A gateway endpoint is a free route table entry that works only for Amazon S3 and DynamoDB from inside the VPC. An interface endpoint is a private IP in your subnet, powered by AWS PrivateLink, that works for most services, can be reached from on premises, and is billed hourly and per GB.

Is there a gateway endpoint for Amazon SQS?

No. Gateway endpoints exist only for Amazon S3 and Amazon DynamoDB. Every other service, including SQS, uses an interface endpoint.

Can on-premises servers use an S3 gateway endpoint?

No. A gateway endpoint is only reachable from inside its own VPC. On-premises clients connected through Direct Connect or VPN need an S3 interface endpoint.

How do VPC endpoints reduce NAT gateway costs?

A gateway endpoint for S3 or DynamoDB sends that traffic through a free route instead of the NAT gateway, so it no longer incurs NAT data processing charges.

See both endpoints built step by step

Chapter 11 of the Certified SAA-C03 course draws the route table change and the per-AZ network interfaces, with a question for each direction. Unit 1 is free.

Open Chapter 11 →