VPC Endpoints: Interface vs Gateway Explained (SAA-C03)
AWS has two kinds of VPC endpoint. A gateway endpoint is free, works only with Amazon S3 and DynamoDB, and routes traffic using a route-table entry. An interface endpoint costs roughly $0.01 per hour per Availability Zone plus data processing, works with hundreds of services, and puts a private ENI in your subnet. This page compares the two side by side — supported services, pricing, DNS, and security — and walks through a worked SAA-C03 practice question.
This question is part of the free AWS Solutions Architect Associate practice test.
Short answer
The correct answer is C. Create a Gateway VPC Endpoint for Amazon S3 and add a route entry to the private subnet route tables.
Amazon S3 and DynamoDB are the only two AWS services that use Gateway VPC Endpoints. A Gateway endpoint is free and works by injecting a route entry into the VPC route table that directs S3 or DynamoDB traffic to the endpoint rather than the internet gateway. No NAT Gateway is needed, no elastic network interfaces are created, and there is no hourly or per-GB charge. This is the standard, cost-effective pattern for private EC2 access to S3. Option A uses a NAT Gateway, which charges $0.045/hour plus per-GB data processing fees — far more expensive than a free Gateway endpoint, and traffic does traverse a managed AWS network, not the public internet, but the cost is unnecessary. Option B would work technically (Interface endpoints support S3), but Interface endpoints cost $0.01/hour per AZ plus per-GB fees — considerably more expensive than the free Gateway endpoint. Option D is not how S3 works and is overly complex.
The Question
A company has a fleet of EC2 instances in private subnets that need to read objects from Amazon S3. The security team requires that no traffic leave the VPC and traverse the public internet. The solutions architect must implement the most cost-effective solution. Which solution meets these requirements?
Why C is correct
Amazon S3 and DynamoDB are the only two AWS services that use Gateway VPC Endpoints. A Gateway endpoint is free and works by injecting a route entry into the VPC route table that directs S3 or DynamoDB traffic to the endpoint rather than the internet gateway. No NAT Gateway is needed, no elastic network interfaces are created, and there is no hourly or per-GB charge. This is the standard, cost-effective pattern for private EC2 access to S3. Option A uses a NAT Gateway, which charges $0.045/hour plus per-GB data processing fees — far more expensive than a free Gateway endpoint, and traffic does traverse a managed AWS network, not the public internet, but the cost is unnecessary. Option B would work technically (Interface endpoints support S3), but Interface endpoints cost $0.01/hour per AZ plus per-GB fees — considerably more expensive than the free Gateway endpoint. Option D is not how S3 works and is overly complex.
Why the other options are wrong
A NAT Gateway allows private instances to reach S3 over the internet-routable AWS network, but it costs $0.045/hour plus data processing fees. A Gateway VPC endpoint provides the same private access for free. The question asks for the most cost-effective solution.
Interface VPC Endpoints use AWS PrivateLink and create Elastic Network Interfaces (ENIs) in your subnets. They charge $0.01/hour per AZ plus $0.01/GB processed. For S3 and DynamoDB specifically, the Gateway endpoint is free and should be preferred on cost grounds.
S3 does not require a Network Load Balancer or custom PrivateLink setup. AWS provides the Gateway endpoint mechanism specifically for S3 and DynamoDB, which is simpler and free.
Gateway vs Interface VPC Endpoints: the complete comparison
VPC endpoints come in two types and the SAA-C03 exam frequently asks you to distinguish them. Gateway Endpoints are free, inject a route into your route table, and work only with S3 and DynamoDB — the two oldest AWS services. You do not pay per-hour or per-GB for a Gateway endpoint. Gateway endpoints are scoped to a region, so a single endpoint can reach all S3 buckets in that region. The route injected into the route table looks like a prefix list (pl-xxxxxxxx) pointing to the endpoint ID. One important gotcha: Gateway endpoints are not extendable from on-premises (via Direct Connect or VPN) or across VPC peering. They only work for traffic originating inside the VPC itself. Interface Endpoints (powered by AWS PrivateLink) work with almost all other AWS services — SSM, EC2 API, CloudWatch, Secrets Manager, Kinesis, and hundreds more. Interface endpoints create ENIs in your subnets with private IP addresses. Applications use the standard service DNS name (or a service-specific private DNS name), and the DNS resolves to the private ENI IP. Interface endpoints cost $0.01/hour per Availability Zone plus $0.01/GB of data processed. They ARE extendable from on-premises via Direct Connect or VPN (because traffic goes to the ENI IP). Key exam decision: S3 or DynamoDB → Gateway Endpoint (free, route-based). Anything else → Interface Endpoint (costs money, ENI-based, extendable). If a question mentions "most cost-effective private access to S3" → always Gateway endpoint. Pricing, in detail, is the difference that decides most exam questions. AWS S3 gateway endpoint pricing is simply zero: there is no hourly charge for the endpoint, no per-GB data processing charge, and no charge for the route-table entry. You still pay normal S3 request and storage charges, and you still pay cross-AZ or cross-region data transfer if your traffic crosses those boundaries, but the endpoint itself adds nothing to the bill. That is why a gateway endpoint is effectively free money compared with a NAT Gateway, which charges about $0.045 per hour per NAT Gateway plus about $0.045 per GB processed — an idle NAT Gateway alone costs roughly $32 per month before a single byte moves. An interface endpoint (S3 interface endpoints exist too, and are billed like any other PrivateLink endpoint) charges about $0.01 per hour for each Availability Zone the endpoint is provisioned in, plus about $0.01 per GB of data processed, with lower per-GB tiers above 1 PB per month. A three-AZ interface endpoint therefore costs roughly $22 per month at rest, times the number of services you front. Prices vary by region, so treat these as the us-east-1 order of magnitude the exam expects rather than exact figures. DNS behavior is the second real difference. A gateway endpoint does not change DNS at all: s3.amazonaws.com still resolves to public IP addresses, and the redirect happens at the routing layer through a managed prefix list in the route table. Because it is route-based, a gateway endpoint cannot be reached from on-premises over Direct Connect or VPN, cannot be used across a VPC peering connection, and cannot be reached from another VPC through Transit Gateway. An interface endpoint does change DNS: with private DNS enabled, the standard service hostname resolves to the private ENI addresses inside your VPC, so unmodified applications and SDKs work with no config change. Because resolution lands on ordinary private IPs, interface endpoints work from on-premises and across peering, Transit Gateway, and other VPCs. Security controls also differ. Both endpoint types support endpoint policies — resource policies that restrict which principals, actions, and resources may be reached through the endpoint, which is how you enforce "only our buckets, only from our VPC." Only interface endpoints support security groups, because only interface endpoints have ENIs to attach them to; a gateway endpoint has no security group and is filtered instead by route tables, endpoint policies, and the aws:SourceVpce and aws:SourceVpc IAM condition keys in your bucket policy. Both types keep traffic on the AWS network rather than the public internet.
Gateway endpoint vs Interface endpoint
| Feature | Gateway endpoint | Interface endpoint (PrivateLink) |
|---|---|---|
| Supported services | Amazon S3 and DynamoDB only | S3, DynamoDB, and hundreds of other AWS and partner services |
| How it works | Adds a prefix-list route to the VPC route table | Creates an elastic network interface with a private IP in your subnet |
| Price | Free | About $0.01 per hour per AZ plus about $0.01 per GB processed |
| Security groups | Not supported; use endpoint policies | Supported, plus endpoint policies |
| Private DNS | Not needed; uses the public service DNS name | Optional; resolves the service name to the endpoint |
| Access from on-premises or a peered VPC | No; only traffic that starts inside the VPC | Yes, over Direct Connect, VPN, peering, or Transit Gateway |
| Scope | Regional; one endpoint per route table set | Per subnet and AZ; deploy in each AZ for resilience |
Gateway vs interface endpoint: side-by-side comparison
| Scenario clue | Choose | Avoid | Why |
|---|---|---|---|
| Supported services | Gateway endpoint: Amazon S3 and DynamoDB only | Interface endpoint: 100+ services (S3 included), plus partner and self-hosted PrivateLink services | If the scenario names any service other than S3 or DynamoDB, a gateway endpoint is not an option at all. |
| Pricing | Gateway endpoint: free — no hourly charge, no data processing charge | Interface endpoint: ~$0.01/hour per AZ plus ~$0.01/GB processed | Any question that says "most cost-effective" and involves S3 or DynamoDB is pointing at the gateway endpoint. |
| How traffic is routed | Gateway endpoint: a prefix-list route (pl-xxxxxxxx) added to the subnet route table | Interface endpoint: an elastic network interface with a private IP in each chosen subnet | Route-based versus ENI-based is the mechanism behind every other difference between the two types. |
| DNS behavior | Gateway endpoint: DNS is unchanged; the public service hostname still resolves publicly | Interface endpoint: private DNS makes the standard hostname resolve to the private ENI IPs | Interface endpoints need private DNS (or the endpoint-specific hostname) for unmodified SDK clients to use them. |
| Access from on-premises, VPC peering, or Transit Gateway | Interface endpoint: works over Direct Connect, VPN, peering, and Transit Gateway | Gateway endpoint: VPC-local only, cannot be reached from outside the VPC | A hybrid or multi-VPC scenario rules out the gateway endpoint even for S3 and DynamoDB. |
| Security controls | Interface endpoint: security groups plus endpoint policies | Gateway endpoint: endpoint policies and route tables only — no security group | Only interface endpoints have ENIs, and security groups can only attach to ENIs. |
Ready to see how you'd score?
Take the free practice quiz and find out which AWS Solutions Architect Associate domains you need to focus on. No signup required.
Practice 5 similar questions
Same cert, same or adjacent domain. Use these after reviewing the explanation.
Related AWS Solutions Architect Associate Practice Questions
Quick FAQ
What is an AWS VPC gateway endpoint?
An AWS VPC gateway endpoint is a free, regional VPC endpoint for Amazon S3 or DynamoDB. You attach it to route tables, and AWS adds a managed prefix-list route so instances in private subnets reach the service over the AWS network without a NAT Gateway or internet gateway.
What is the difference between an interface endpoint and a gateway endpoint?
A gateway endpoint works only with Amazon S3 and DynamoDB, is free, and routes traffic by adding a prefix-list entry to your VPC route table. An interface endpoint uses AWS PrivateLink to create an elastic network interface with a private IP in your subnets, works with S3, DynamoDB, and hundreds of other services, supports security groups and private DNS, and costs about $0.01 per hour per Availability Zone plus about $0.01 per GB of data processed.
What does an AWS VPC gateway endpoint cost?
Nothing. AWS charges no hourly fee and no data processing fee for gateway endpoints. You still pay normal S3 or DynamoDB request and storage charges and any cross-AZ or cross-region data transfer, but the endpoint itself is free. This is the main reason a gateway endpoint beats a NAT Gateway, which costs about $0.045 per hour plus about $0.045 per GB processed.
What is an S3 gateway endpoint?
An S3 gateway endpoint is a VPC endpoint that lets instances in private subnets reach Amazon S3 without a NAT Gateway or internet gateway. You create the endpoint, associate it with your route tables, and AWS adds a managed prefix-list route that sends S3-bound traffic to the endpoint over the AWS network. It is regional, so one endpoint covers every S3 bucket in that region.
What is AWS S3 gateway endpoint pricing?
S3 gateway endpoints are free of charge — there is no per-hour or per-GB endpoint cost in any region. If you instead use an S3 interface endpoint you pay roughly $0.01 per hour for each Availability Zone plus roughly $0.01 per GB of data processed, so a three-AZ interface endpoint runs about $22 per month before data charges. Choose the gateway endpoint unless you need on-premises or cross-VPC access.
When should I use an interface endpoint instead of a gateway endpoint for S3?
Use an S3 interface endpoint when traffic originates outside the VPC — from on-premises over Direct Connect or VPN, from a peered VPC, or through Transit Gateway — or when you need security groups and private DNS resolution to the endpoint. Gateway endpoints only serve traffic that originates inside the VPC that holds the route table. Many designs use both: a free gateway endpoint for in-VPC traffic and an interface endpoint for hybrid access.
Which AWS services support gateway endpoints?
Only Amazon S3 and Amazon DynamoDB. Every other AWS service that supports VPC endpoints — Systems Manager, Secrets Manager, CloudWatch, KMS, ECR, Kinesis, the EC2 API, and hundreds more — uses interface endpoints backed by AWS PrivateLink.