VPC Endpoints for Provider Services

Keep provider traffic on the private network

Managed services like Amazon S3 or SQS have public endpoints. Without extra configuration, a private instance reaches them through the NAT gateway and internet gateway, which adds cost and widens the egress path. VPC endpoints fix this. AWS offers two kinds. A gateway endpoint exists only for S3 and DynamoDB: it adds a route to the subnet route tables using a managed prefix list of the service's addresses, and it has no hourly charge. An interface endpoint, built on AWS PrivateLink, creates elastic network interfaces with private IPs in your subnets for a specific service; with private DNS enabled, the service's usual hostname resolves to those private IPs, so applications need no code change. Interface endpoints are billed per hour per AZ and per GB. Both kinds can carry an endpoint policy restricting which actions or resources are reachable. In Google Cloud, Private Google Access and Private Service Connect provide comparable private paths.

A gateway endpoint for S3 in Terraform

Attaching it to the private route tables adds the S3 prefix-list route automatically.

resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.ap-south-1.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private_a.id, aws_route_table.private_b.id]
}

Endpoint policies are a data-loss control

An endpoint policy that only allows your organisation's buckets stops a compromised instance from copying data to an attacker's bucket over the same private path.

त्वरित जाँच: Which services can use an AWS gateway VPC endpoint?

• S3 and DynamoDB
• Any AWS service
• Only services running in your own VPC
• EC2 and RDS