VPC Endpoints: Interface, Gateway, and Keeping Traffic Off the Public Internet

Three endpoint types

| Type | How it works | Services | Cost | |---|---|---|---| | Gateway | Route table entry → S3/DynamoDB prefix list | S3, DynamoDB only | Free | | Interface | ENI deployed in subnet, DNS resolves to private IP | Most AWS services | $0.01/hour/AZ + $0.01/GB | | Gateway Load Balancer | ENI for transparent traffic inspection | Third-party appliances | Variable |

Gateway endpoints are the correct choice for S3 and DynamoDB — they're free and don't require DNS changes. Interface endpoints (powered by PrivateLink) work for everything else.

Gateway endpoints: S3 and DynamoDB

Gateway endpoints add a prefix list entry to route tables. Traffic to S3 or DynamoDB goes through the endpoint rather than the internet or NAT.

# S3 Gateway endpoint — free, no ENI
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.us-east-1.s3"
  vpc_endpoint_type = "Gateway"

  # Associate with route tables to route S3 traffic through endpoint
  route_table_ids = [
    aws_route_table.private.id,
    aws_route_table.public.id,
  ]
}

After creating the endpoint, AWS adds a managed prefix list entry (e.g., pl-63a5400a) to the associated route tables. Any traffic to S3 IP ranges matches this prefix and routes through the endpoint.

Check that the endpoint is associated with the correct route tables:

aws ec2 describe-vpc-endpoints \
  --filters "Name=service-name,Values=com.amazonaws.us-east-1.s3" \
  --query "VpcEndpoints[].{ID:VpcEndpointId,State:State,RouteTables:RouteTableIds}"

Interface endpoints: all other services

# Secrets Manager interface endpoint
resource "aws_vpc_endpoint" "secretsmanager" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.us-east-1.secretsmanager"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = var.private_subnet_ids   # ENI deployed in these subnets
  security_group_ids  = [aws_security_group.vpc_endpoint.id]
  private_dns_enabled = true   # critical: makes SDK use private endpoint
}

resource "aws_security_group" "vpc_endpoint" {
  name   = "vpc-endpoint-sg"
  vpc_id = aws_vpc.main.id

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = [aws_vpc.main.cidr_block]
  }
}

The security group on the endpoint controls which VPC resources can reach it — the endpoint's ENI must allow inbound 443 from resources that need to use it.

For high availability, deploy endpoints in multiple AZs:

resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.us-east-1.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = var.private_subnet_ids   # one subnet per AZ
  security_group_ids  = [aws_security_group.vpc_endpoint.id]
  private_dns_enabled = true
}

# ECR also requires the docker endpoint and S3 gateway endpoint
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.us-east-1.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = var.private_subnet_ids
  security_group_ids  = [aws_security_group.vpc_endpoint.id]
  private_dns_enabled = true
}

ECR requires two endpoints: ecr.api for the ECR API and ecr.dkr for Docker image pulls. Both are needed, plus an S3 gateway endpoint (ECR stores image layers in S3).

locals {
  interface_endpoints = [
    "com.amazonaws.${var.region}.ecr.api",
    "com.amazonaws.${var.region}.ecr.dkr",
    "com.amazonaws.${var.region}.ecs",
    "com.amazonaws.${var.region}.ecs-agent",
    "com.amazonaws.${var.region}.ecs-telemetry",
    "com.amazonaws.${var.region}.logs",           # CloudWatch Logs
    "com.amazonaws.${var.region}.ssm",            # SSM Session Manager
    "com.amazonaws.${var.region}.ssmmessages",
    "com.amazonaws.${var.region}.ec2messages",
    "com.amazonaws.${var.region}.secretsmanager",
  ]
}

resource "aws_vpc_endpoint" "services" {
  for_each = toset(local.interface_endpoints)

  vpc_id              = aws_vpc.main.id
  service_name        = each.value
  vpc_endpoint_type   = "Interface"
  subnet_ids          = var.private_subnet_ids
  security_group_ids  = [aws_security_group.vpc_endpoint.id]
  private_dns_enabled = true
}

# S3 gateway endpoint for ECR image layer pulls
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}