Instiq
Chapter 4 · Network Implementation·v2.1.0·Updated 6/14/2026·~11 min

What's changed: In-scope coverage: added compute/scaling/storage (EC2 Auto Scaling/AWS Auto Scaling/ECS/Fargate/Lambda/S3)

4.1Implementing VPC Endpoints

Key points

Connect privately—understand gateway endpoints, interface endpoints, PrivateLink, and private DNS. Reach AWS services without traversing the internet.

A VPC endpoint lets resources in a VPC reach AWS services without the internet. Depending on the target, it is either a "gateway" or an "interface" endpoint.

4.1.1Two endpoint types

Diagram comparing gateway and interface VPC endpoints: a gateway endpoint targets only S3 and DynamoDB, works as a route-table target (prefix list), has no ENI, no extra cost, and stays on the AWS network; an interface endpoint targets most AWS services and PrivateLink, is created as an ENI with a private IP in a subnet, has a security group applied, and incurs hourly plus data cost; S3/DynamoDB use gateway, everything else uses interface (ENI).
Gateway vs interface endpoints
  • Gateway endpoint: for S3 and DynamoDB only. Added as a route-table target. No ENI, no extra charge.
  • Interface endpoint: for most AWS services and PrivateLink. Creates an ENI (private IP) in a subnet; security groups apply.
  • Private DNS: enabling it makes the regular service name resolve to the private IP of the interface endpoint.
  • Choosing: S3/DynamoDB = gateway; everything else (many services, exposing your own service) = interface/PrivateLink.

Continue reading — free sign-up

You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.

Get started freeLog in