VPC Endpoints: Interface vs Gateway Explained (SAA-C03)
VPC endpoints let EC2 instances and Lambda functions access AWS services without routing traffic over the public internet. The SAA-C03 exam tests which type of endpoint applies to which service — and the cost and routing differences between them.
Short answer
The correct answer is C. Create a Gateway VPC Endpoint for Amazon S3 and add a route entry to the private subnet route tables.
Amazon S3 and DynamoDB are the only two AWS services that use Gateway VPC Endpoints. A Gateway endpoint is free and works by injecting a route entry into the VPC route table that directs S3 or DynamoDB traffic to the endpoint rather than the internet gateway. No NAT Gateway is needed, no elastic network interfaces are created, and there is no hourly or per-GB charge. This is the standard, cost-effective pattern for private EC2 access to S3. Option A uses a NAT Gateway, which charges $0.045/hour plus per-GB data processing fees — far more expensive than a free Gateway endpoint, and traffic does traverse a managed AWS network, not the public internet, but the cost is unnecessary. Option B would work technically (Interface endpoints support S3), but Interface endpoints cost $0.01/hour per AZ plus per-GB fees — considerably more expensive than the free Gateway endpoint. Option D is not how S3 works and is overly complex.
The Question
A company has a fleet of EC2 instances in private subnets that need to read objects from Amazon S3. The security team requires that no traffic leave the VPC and traverse the public internet. The solutions architect must implement the most cost-effective solution. Which solution meets these requirements?
Why C is correct
Amazon S3 and DynamoDB are the only two AWS services that use Gateway VPC Endpoints. A Gateway endpoint is free and works by injecting a route entry into the VPC route table that directs S3 or DynamoDB traffic to the endpoint rather than the internet gateway. No NAT Gateway is needed, no elastic network interfaces are created, and there is no hourly or per-GB charge. This is the standard, cost-effective pattern for private EC2 access to S3. Option A uses a NAT Gateway, which charges $0.045/hour plus per-GB data processing fees — far more expensive than a free Gateway endpoint, and traffic does traverse a managed AWS network, not the public internet, but the cost is unnecessary. Option B would work technically (Interface endpoints support S3), but Interface endpoints cost $0.01/hour per AZ plus per-GB fees — considerably more expensive than the free Gateway endpoint. Option D is not how S3 works and is overly complex.
Why the other options are wrong
A NAT Gateway allows private instances to reach S3 over the internet-routable AWS network, but it costs $0.045/hour plus data processing fees. A Gateway VPC endpoint provides the same private access for free. The question asks for the most cost-effective solution.
Interface VPC Endpoints use AWS PrivateLink and create Elastic Network Interfaces (ENIs) in your subnets. They charge $0.01/hour per AZ plus $0.01/GB processed. For S3 and DynamoDB specifically, the Gateway endpoint is free and should be preferred on cost grounds.
S3 does not require a Network Load Balancer or custom PrivateLink setup. AWS provides the Gateway endpoint mechanism specifically for S3 and DynamoDB, which is simpler and free.
Gateway vs Interface VPC Endpoints: the complete comparison
VPC endpoints come in two types and the SAA-C03 exam frequently asks you to distinguish them. Gateway Endpoints are free, inject a route into your route table, and work only with S3 and DynamoDB — the two oldest AWS services. You do not pay per-hour or per-GB for a Gateway endpoint. Gateway endpoints are scoped to a region, so a single endpoint can reach all S3 buckets in that region. The route injected into the route table looks like a prefix list (pl-xxxxxxxx) pointing to the endpoint ID. One important gotcha: Gateway endpoints are not extendable from on-premises (via Direct Connect or VPN) or across VPC peering. They only work for traffic originating inside the VPC itself. Interface Endpoints (powered by AWS PrivateLink) work with almost all other AWS services — SSM, EC2 API, CloudWatch, Secrets Manager, Kinesis, and hundreds more. Interface endpoints create ENIs in your subnets with private IP addresses. Applications use the standard service DNS name (or a service-specific private DNS name), and the DNS resolves to the private ENI IP. Interface endpoints cost $0.01/hour per Availability Zone plus $0.01/GB of data processed. They ARE extendable from on-premises via Direct Connect or VPN (because traffic goes to the ENI IP). Key exam decision: S3 or DynamoDB → Gateway Endpoint (free, route-based). Anything else → Interface Endpoint (costs money, ENI-based, extendable). If a question mentions "most cost-effective private access to S3" → always Gateway endpoint.
Ready to see how you'd score?
Take the free practice quiz and find out which AWS Solutions Architect Associate domains you need to focus on. No signup required.
Practice 5 similar questions
Same cert, same or adjacent domain. Use these after reviewing the explanation.