Module 3 of 6 • Private Connectivity to AWS Services
VPC Endpoints: Gateway Endpoints vs. Interface Endpoints (PrivateLink)
Why pay NAT Gateway fees and send traffic toward the public internet just to talk to Amazon S3, DynamoDB, or Secrets Manager in the same region?
Switch between the three connectivity modes below to see how Gateway Endpoints and Interface Endpoints (PrivateLink) keep traffic 100% private.
🚇
The Everyday Mental Model: Imagine your office building (VPC) is next door to the AWS Bank Vault (S3 / KMS).
Without an Endpoint, your courier has to walk out the front door onto the public street (through NAT + IGW) to enter the bank.
A Gateway Endpoint (for S3 & DynamoDB) adds a free private hallway door on your building map (Route Table).
An Interface Endpoint (PrivateLink) installs a dedicated bank teller window (an ENI with its own private IP) right inside your locked back office!