What is the difference between a gateway endpoint, an interface endpoint and PrivateLink?
Show the answer
Say this first
A gateway endpoint is a route table entry that sends S3 or DynamoDB traffic over the AWS network; it is free and only works from inside that VPC. An interface endpoint is an ENI with a private IP in your subnet that fronts a service; it is built on PrivateLink, costs per hour and per GB, and can be reached from on-prem and peered networks. PrivateLink also lets you publish your own service behind an NLB to other VPCs, one way only, even with overlapping CIDRs.
Go deeper
Gateway endpoint (S3, DynamoDB only)
- Adds a prefix list route (
pl-...) to the route tables you choose. - No hourly charge, no data processing charge.
- Cannot be used from on-prem, a peered VPC or through a transit gateway.
Interface endpoint (most AWS services)
- One ENI per chosen AZ, with a security group.
- Private DNS option makes the normal service name (for example
sqs.us-east-1.amazonaws.com) resolve to the endpoint IPs inside the VPC. - Reachable over VPN, Direct Connect, peering and transit gateway.
Your own service with PrivateLink
consumer VPC (10.0.0.0/16) provider VPC (10.0.0.0/16, same range)
app -> interface endpoint 10.0.5.20 -> PrivateLink -> NLB -> service targetsThe provider creates an endpoint service from an NLB and allows principals. The consumer creates an interface endpoint. Only the consumer can start connections. The provider sees the NLB's address as the source unless it enables proxy protocol v2.
Azure and GCP
- Azure Private Endpoint: a NIC with a private IP mapped to one specific resource (one storage account, one SQL server). Service endpoints are older: the service still has a public IP, but the subnet's identity is used to allow access, and on-prem cannot use them. Private Link service publishes your own service behind a Standard Load Balancer.
- GCP Private Service Connect: an internal IP endpoint for Google APIs or for services published by producers with a service attachment. Private Google Access lets VMs without external IPs reach Google APIs.
They will ask next
Why does a backup job to S3 cost a fortune through NAT, and what is the fix?
The NAT gateway charges per GB processed. A free S3 gateway endpoint in the route table sends that traffic around the NAT gateway.
Can an endpoint policy stop data exfiltration?
It helps. An endpoint policy can allow only your own buckets through the endpoint, so a compromised host cannot copy data to an outside bucket over that path. Pair it with bucket policies that require the endpoint.
Traps
- Expecting on-prem to use an S3 gateway endpoint. It needs an interface endpoint.
- Forgetting the security group on an interface endpoint, which must allow 443 from clients.