What's changed: In-scope coverage: added compute/scaling/storage (EC2 Auto Scaling/AWS Auto Scaling/ECS/Fargate/Lambda/S3)
4.1Implementing VPC Endpoints
Connect privately—understand gateway endpoints, interface endpoints, PrivateLink, and private DNS. Reach AWS services without traversing the internet.
A VPC endpoint lets resources in a VPC reach AWS services without the internet. Depending on the target, it is either a "gateway" or an "interface" endpoint.
4.1.1Two endpoint types
- Gateway endpoint: for S3 and DynamoDB only. Added as a route-table target. No ENI, no extra charge.
- Interface endpoint: for most AWS services and PrivateLink. Creates an ENI (private IP) in a subnet; security groups apply.
- Private DNS: enabling it makes the regular service name resolve to the private IP of the interface endpoint.
- Choosing: S3/DynamoDB = gateway; everything else (many services, exposing your own service) = interface/PrivateLink.
Common on ANS-C01: private access to S3/DynamoDB = gateway endpoint (route table, free), other services = interface endpoint (ENI, SG, charged), and expose your own service to other VPCs = PrivateLink. Distinguish gateway (route table) from interface (ENI).
ANS-C01 tests DNS and access-control details and the difference between S3’s two endpoint kinds. Enabling private DNS on an interface endpoint makes the resolver resolve the service’s normal name (e.g., secretsmanager.ap-northeast-1.amazonaws.com) to the endpoint ENI’s private IP—switching existing code to the private path with no change; to resolve it from outside the VPC (on-prem), point resolution to the VPC via a Route 53 Resolver inbound endpoint. Access control is two-layered: an endpoint policy (resource-based IAM) limits which APIs/resources are allowed through the endpoint, and for interface endpoints a security group on the ENI further restricts the source on port 443. S3 has, besides the classic gateway endpoint, an S3 interface endpoint for reaching S3 over a private IP from on-prem or another VPC/Region (the gateway kind is limited to same-Region, same-VPC route tables and is unusable from on-prem). Combining VPC endpoint policies with an S3 bucket policy aws:sourceVpce condition builds a strong boundary that permits access only through a specific endpoint.
| Aspect | Gateway | Interface |
|---|---|---|
| Target services | S3 and DynamoDB only | Many AWS services + PrivateLink |
| Implementation | Prefix list in route table | ENI (private IP) in subnet |
| Cost | Free | Hourly + data processing |
| From on-prem/other VPC | No (same VPC only) | Yes (via DX/VPN/peering) |
| Security group | None | Yes (on the ENI) |
Scenario: an on-prem batch accesses S3 over Direct Connect, must never traverse the internet, and only one bucket is allowed. → Create an S3 interface endpoint (the gateway kind is unusable from on-prem), and restrict to the target bucket/endpoint via the endpoint policy and the bucket policy’s aws:sourceVpce. Point on-prem name resolution to the VPC with a Route 53 Resolver inbound endpoint.
FAQ: Q. Private DNS enabled but not resolving? A. It won’t work unless the VPC’s DNS hostnames/DNS resolution (enableDnsSupport / enableDnsHostnames) are on—enable both. Q. Attach an SG to a gateway endpoint? A. You can’t; control access via the endpoint policy and route table. If you need an SG, use an interface endpoint.
Trap: "with VPC endpoints you never need a NAT gateway" is false. Endpoints only provide a path to the targeted AWS services; general internet egress (OS package fetches, arbitrary external APIs) still needs NAT. Conversely, using NAT just to reach S3 wastes cost—a gateway endpoint is the right answer.
4.1.2Section summary
- S3/DynamoDB = gateway; others = interface (ENI)
- Expose own service = PrivateLink; name resolution = private DNS
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. From a private-subnet EC2, access S3 without the internet and at no extra cost. What do you implement?
Q2. Connect privately from a VPC to many AWS services like Systems Manager or Secrets Manager. What?
Q3. Which is correct about interface endpoints?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.