All cheat sheets
Networkingcheat sheet

VPC Endpoints

Gateway Endpoints (free, S3/DynamoDB) and Interface Endpoints ($7.20/month + $0.01/GB, most other services) keep AWS-service traffic off the public internet — cutting $0.09/GB transfer and $0.045/GB NAT fees. Know the break-even before creating fifteen of them.

Last reviewed: July 11, 2026

Prefer step by step? Take the guided VPC Endpoints walkthrough — free, anonymous, interactive.Have an AI assistant? Jump to the copy-paste audit prompt at the bottom of this sheet.

TL;DR: Two different products share the "VPC Endpoint" name. Gateway Endpoints (S3, DynamoDB only) are completely free and should exist in effectively every VPC. Interface Endpoints (PrivateLink, most other services) cost $0.01/hour (~$7.20/month) plus $0.01/GB — a clear win above ~100–200 GB/month per service versus $0.09/GB internet transfer or $0.045/GB NAT processing, and a small money-loser below it. The classic failure is creating fifteen "just in case" endpoints that idle at $108/month.

The numbers

1 TB/month to one service, three ways:

Path Cost/month
Public internet transfer ~$90
Through NAT Gateway ~$45
Interface Endpoint $7.20 + $10 = $17.20

At 50 GB/month the endpoint loses ($7.70 vs $4.50 direct). Field example: 10 TB/month of ECS↔S3 traffic at $900/month in transfer fees → $0 with a free Gateway Endpoint, in ten minutes.

Do this

  1. Gateway Endpoints first, always: free, zero downside — full walkthrough here.

  2. Rank your chattiest services (Cost Explorer data-transfer lines, NAT bytes, CloudWatch Logs ingestion volume). CloudWatch Logs, ECR (image pulls), SQS, and Kinesis are the usual Interface-Endpoint winners.

  3. Apply the break-even rule per service: monthly GB × avoided rate vs $7.20 + GB × $0.01. Above ~100–200 GB/month, create it:

    aws ec2 create-vpc-endpoint --vpc-id vpc-0abc123 \
  --vpc-endpoint-type Interface \
  --service-name com.amazonaws.us-east-1.logs \
  --subnet-ids subnet-aaa subnet-bbb \
  --security-group-ids sg-0123 --private-dns-enabled

  4. Enable Private DNS (as above) or applications keep resolving the public hostname and route through NAT anyway — paying for the endpoint and the NAT.

  5. Prune quarterly. Traffic shifts; an endpoint that cleared break-even last year may be idling now.

Gotchas

  • The hourly fee is per endpoint per AZ — a "comprehensive" endpoint collection across 3 AZs multiplies fast. One team's 15-service collection cost $108/month; analysis showed 3 had meaningful traffic.
  • Endpoints are region-scoped — multi-region estates need them per region; cross-region transfer still bills.
  • Endpoint security groups apply — misconfigured SGs on Interface Endpoints produce mysterious connection failures.
  • Compliance can trump the math: "no AWS traffic over public internet" mandates justify endpoints below break-even — and sometimes let you delete the NAT Gateway entirely (one healthcare team came out cheaper and more compliant).

Skip this if

  • Volumes are tiny (< ~100 GB/month per service) and no compliance driver exists — pay the transfer fee.
  • The traffic is same-region EC2→S3 style flows that already cost nothing without NAT in the path.
  • The bigger leak is NAT sprawl itself — fix NAT consolidation and CloudFront for user-facing egress alongside.

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are auditing an AWS account's VPC Endpoint posture — both missing
endpoints that would save money and existing endpoints that cost more
than they save. Use the AWS CLI with READ-ONLY credentials. Do not
create, modify, or delete anything.

1. Inventory per region: aws ec2 describe-vpc-endpoints — split
   Gateway vs Interface; note service names, VPCs, and (for Interface)
   whether Private DNS is enabled.
2. Missing free wins: VPCs with NAT gateways or internet-bound AWS API
   traffic but no S3/DynamoDB Gateway Endpoints.
3. Interface endpoint math, both directions:
   - Candidates to ADD: services with heavy traffic from private
     subnets (CloudWatch Logs ingestion, ECR pulls, SQS, Secrets
     Manager). Estimate GB/mo (CloudWatch/NAT metrics); endpoint wins
     when GB/mo × ($0.045 NAT or $0.09 internet) exceeds $7.20 +
     GB × $0.01. Break-even ≈ 100–200 GB/mo.
   - Candidates to REMOVE: existing Interface endpoints on services
     with negligible traffic (the "endpoints for everything just in
     case" anti-pattern) — each idle one is $7.20/mo × AZs.
4. Config checks: Interface endpoints without Private DNS (apps may
   still route publicly = paying twice); endpoint security groups that
   block the intended consumers.

Report: (a) missing Gateway Endpoints; (b) Interface endpoints to add
with per-service math; (c) Interface endpoints to delete with monthly
waste; (d) misconfigurations. Include commands for review — but do NOT
execute them.
Works with any assistant that can run shell commands.

Want the guided version?

The VPC Endpoints walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough

More Networking cheat sheets

AWS Direct Connect

A dedicated line to AWS drops Data Transfer Out from $0.09/GB to ~$0.02/GB — a 66–75% cut that pays for the port fee many times over at 20+ TB/month of hybrid traffic, and loses money below ~5 TB.

AWS PrivateLink

Interface Endpoints route AWS-service traffic through your VPC privately at $0.01/GB — 4.5× cheaper than NAT Gateway data processing. The payoff is biggest on chatty services: ECR, CloudWatch Logs, Secrets Manager.

AWS WAF Rule Optimization

One rule per blocked IP or bot signature is how teams hit WAF's 1,500-WCU ceiling and a $1/rule/month bill. IP Sets, Regex Pattern Sets, and combined conditions collapse 50 rules into 10 — same protection, 60%+ less capacity and cost.

CloudFront Egress Discounts

Counterintuitive but true: putting CloudFront in front of S3, EC2, or an ALB usually makes the egress bill smaller — CDN transfer rates undercut direct Data Transfer Out, and edge caching removes origin traffic entirely. 30–55% cuts are typical at scale.