VPC Endpoints

VPC Endpoint Features & AWS Solution Architect Associate Exam Revision Doc

What are VPC Endpoints?

VPC Endpoints provide private, direct connectivity between your Amazon VPC and supported AWS services, keeping all traffic inside the AWS network—without traversing the public internet1 2 3 4.

Types of VPC Endpoints

Type	Description	Common Use-cases	Supported Services
Gateway Endpoint	Targets a specific AWS service. Route table is updated to direct traffic to the endpoint.	S3, DynamoDB access from private subnets	Amazon S3, Amazon DynamoDB1 2 4 9
Interface Endpoint (AWS PrivateLink)	Elastic Network Interface (ENI) in your subnet, assigned private IPs.	Most AWS services (SNS, SQS, EC2 APIs, etc.), third-party SaaS	Many AWS and partner services1 2 4
Gateway Load Balancer Endpoint	Connects traffic to Gateway Load Balancers for security/inspection; used for advanced networking scenarios.	Network appliance integration, firewalls	GWLB (not usually in SAA exam)4

Key Features and Benefits

Enhanced Security: Traffic never leaves AWS, reducing exposure and attack surface. Minimizes risks of DDoS, data interception, or unauthorized access1 2 3 4.
Cost Optimization: Avoids NAT Gateway and data transfer costs for S3/DynamoDB by staying within AWS; saves on internet egress fees2 4 8.
Performance: Lower latency and higher bandwidth than traversing internet; suitable for real-time and high-throughput workloads1 2 3.
Compliance: Meets regulatory or compliance needs by avoiding public internet routes, keeping data within the AWS backbone1 3.
Simplified Network Management: No complex firewall or NAT configuration, easier IAM integration and access control policies1 2 3 4.
High Availability: VPC endpoints are horizontally scaled and redundant within your VPC4.
Fine-grained Access Control: You can use VPC endpoint policies, IAM, and security groups for granular permissions2 3.

Typical Exam Use-Cases

Private Access to AWS Services: S3 buckets need to be accessed from EC2 in private subnets—gateway VPC endpoint required2 9.
Avoiding NAT Gateway Fees: Applications reading/writing from S3 without public subnet or NAT2 4.
Restricting Internet Exposure: Service inside a VPC must not use public IPs to call SQS/SNS—interface VPC endpoint needed2 4.
Compliance Requirement: Customer data must not traverse the internet when accessing AWS services—use VPC endpoints1 3.

How VPC Endpoints Work

Gateway endpoints: Update the VPC route table to add a route for the AWS service (S3/DynamoDB), directing it to the endpoint target2 9.
Interface endpoints: Create an ENI in your subnet, with a private IP and security group; access AWS services privately using this ENI2 4.
Gateway Load Balancer endpoints: Specific for forwarding/inspecting traffic, not commonly used on the SAA exam4.

Configuration Steps High-Level

Create VPC Endpoint (Gateway or Interface) in AWS Console or CLI.
Configure Route Tables (Gateway) or Security Groups (Interface) to control access.
Optional: Attach IAM policies for fine-grained service actions.

Exam Revision Table

Topic	Key Points
Supported services	S3/DynamoDB: Gateway; Others: Interface
Traffic path	Remains within AWS global network
Security and compliance	No public internet; reduced attack surface; meet compliance requirements
Cost savings	Avoids NAT/internet gateway charges (especially for S3/DynamoDB); no egress fees
Configuration	Gateway: Route tables; Interface: Security Groups
Scalability/Availability	Horizontally scaled, redundant (managed by AWS)

Notes & Limitations

Not all AWS services support gateway endpoints—check exam questions for service compatibility1 2 4 9.
VPC endpoints are region-specific.
Some limitations and design impacts exist (e.g., endpoint quota per VPC)1.

For the AWS Solutions Architect Associate exam, know when and how to use VPC Endpoints—especially for private S3/DynamoDB access, security, and cost optimization scenarios.

🪴 DEEPAK NISHAD

Explorer