Gateway endpoint or interface endpoint for Amazon S3
Amazon S3 can be reached privately two ways: with a free gateway endpoint, or with a chargeable interface endpoint powered by AWS PrivateLink. Most estates start with the gateway endpoint and add an interface endpoint when something outside the VPC needs the same path.
Use a gateway endpoint when
Section titled “Use a gateway endpoint when”The callers are inside the VPC and the requirement is ordinary S3 access — GetObject, PutObject, and the rest of the API.
What it gives you
- No charge, for either the endpoint or the data.
- Simple to create: make the endpoint and select the route tables it should appear in.
- Full S3 API coverage at the performance of the AWS internal network.
- An endpoint policy for restricting which buckets and actions the path allows.
What it does not give you
- Reach from outside the VPC. A gateway endpoint is a route table entry, so it works only for traffic originating in that VPC. Traffic arriving over a peering connection, a transit gateway, a VPN or Direct Connect cannot use it.
- A security group. Access is controlled with the endpoint policy and the bucket policy instead.
- Anything other than S3 and DynamoDB — those are the only two services with gateway endpoints.
Use an interface endpoint when
Section titled “Use an interface endpoint when”Something other than an instance in this VPC needs the private path.
What it gives you
- Reach from on-premises over Direct Connect or VPN, from peered VPCs, and from other VPCs across a transit gateway.
- Private IP addresses inside your own subnets, which some corporate routing and firewall policies require.
- A security group in front of the endpoint interfaces.
- Finer DNS control, including reaching S3 in another Region through a cross-Region endpoint.
What it costs
- An hourly charge per endpoint per Availability Zone, plus a per-gigabyte data processing charge.
- One more thing to size and monitor.
Deciding
Section titled “Deciding”Choose the gateway endpoint for straightforward VPC-to-S3 access where cost matters, which is the majority of cases.
Choose the interface endpoint where on-premises systems, several VPCs behind a transit gateway, or fixed private addressing are part of the requirement.
The two are not exclusive. A common arrangement is a gateway endpoint carrying the bulk of in-VPC traffic at no cost, alongside an interface endpoint for the hybrid path — with S3 private DNS configured so that each caller resolves to the right one.