VPC endpoints

A VPC endpoint gives resources in a VPC a private path to a service or resource outside it, without an internet gateway, NAT device, VPN or Direct Connect connection. Traffic does not leave the AWS network, and instances need no public IP address.

There are five kinds. Four are built on AWS PrivateLink; the gateway endpoint is not.

Interface endpoints

Create one or more endpoint network interfaces in subnets you choose, each with a private IP address from the subnet range.
Reach AWS service endpoints, endpoint services published by other accounts, and SaaS offerings.
Require a security group, and support an endpoint policy.
Depend on DNS: with private DNS enabled the service’s normal hostname resolves to the endpoint’s private addresses, so applications need no change.
Billed per endpoint-hour per Availability Zone plus per gigabyte processed.

Gateway endpoints

Not a network interface at all — a route table entry. You create the endpoint and select the route tables it should appear in, and AWS adds a route sending traffic for that service’s prefix list to the endpoint.
Support exactly two services: Amazon S3 and Amazon DynamoDB.
Free of charge.
Region-specific, and reachable only from within the VPC that contains them — not from a peered VPC, a transit gateway attachment or on-premises.
Have no security group; access is controlled with an endpoint policy and with the bucket or table policy.

Gateway Load Balancer endpoints

Send traffic to a fleet of third-party virtual appliances — firewalls, intrusion detection, deep packet inspection — that live in a separate inspection VPC.
Traffic is routed to the endpoint from a route table, and the Gateway Load Balancer distributes it across appliances using the GENEVE protocol on port 6081.
Used to insert inspection into a traffic path transparently. See Gateway Load Balancer.

Resource endpoints

Reach a single resource shared with you from another VPC or from on-premises — a database, an EC2 instance, an application endpoint, a domain-name target or an IP address.
No load balancer is needed on the provider side; the provider creates a resource gateway and shares a resource configuration through AWS Resource Access Manager.
Useful when the thing you want to expose is one database, not a service tier.

Service-network endpoints

Reach a whole Amazon VPC Lattice service network through a single endpoint, rather than one endpoint per service.
The service network owner associates services and resource configurations with it and shares it through Resource Access Manager.

Choosing

You need	Use
Private access to Amazon S3 or DynamoDB from inside one VPC, cheaply	Gateway endpoint
Private access to S3 or DynamoDB from on-premises, a peered VPC or across a transit gateway	Interface endpoint
Private access to another AWS service, or to a SaaS or partner service	Interface endpoint
To insert firewalls or inspection appliances into a traffic path	Gateway Load Balancer endpoint
To reach one shared database or host in another VPC	Resource endpoint
To reach many services behind VPC Lattice	Service-network endpoint

Gateway endpoint or interface endpoint, from the instance’s point of view

An EC2 instance sees no difference. It makes the same aws s3 ls call through the same SDK.

With a gateway endpoint, the route table sends traffic destined for the S3 prefix list to the endpoint. Nothing on the instance changes and no interface appears in the subnet.
With an interface endpoint, the DNS name resolves to a private address inside the subnet, and the traffic goes to a real network interface that has a security group in front of it.

The difference shows up in three places: cost (gateway endpoints are free), reach (only interface endpoints are reachable from outside the VPC), and control (only interface endpoints have a security group).