Use a gateway endpoint for Amazon S3 or DynamoDB traffic that stays within a VPC and Region: it directs traffic through route tables and has no additional endpoint charge. Choose an interface endpoint when you need PrivateLink access from on-premises or connected networks, or need a supported AWS service that does not offer a gateway endpoint. Interface endpoints use private IP addresses and incur hourly and data-processing charges.
Both can avoid requiring an internet gateway or NAT device for the service path. That does not mean every request to an AWS public service endpoint otherwise crosses the public internet: AWS says traffic can pass through an internet gateway without leaving its network.
As an Amazon Associate I earn from qualifying purchases.
How gateway and interface endpoints direct traffic
Gateway endpoints use route tables
A gateway endpoint adds a route-table entry for traffic to Amazon S3 or DynamoDB. The route sends matching service traffic to the endpoint rather than requiring a NAT device or internet gateway for that path. AWS states that gateway endpoints have no additional endpoint charge; ordinary service and data-transfer charges still apply. AWS gateway endpoints for Amazon S3 and AWS gateway endpoints for DynamoDB.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Interface endpoints use PrivateLink network interfaces
An interface endpoint provisions one or more endpoint network interfaces in your VPC. Each has a private IP address, and DNS can resolve supported service requests to those private addresses. Interface endpoints use AWS PrivateLink and are available for many AWS services, though support varies by service and Region. AWS interface VPC endpoints.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Which endpoint should you choose?
| Decision | Gateway endpoint | Interface endpoint |
|---|---|---|
| Services | Amazon S3 and DynamoDB. | Many AWS services integrated with PrivateLink; check service and Region availability. |
| Traffic direction | Route-table entry targets the endpoint for S3 or DynamoDB traffic. | Private IP addresses on endpoint network interfaces; DNS can direct service traffic to them. |
| Reach | For traffic originating in the VPC; not for on-premises networks, VPCs peered from another Region, or traffic through a transit gateway. | Supports broader private access. For S3, AWS documents on-premises and connected-VPC scenarios. |
| Endpoint charges | No additional endpoint charge; normal service and data-transfer charges still apply. | Hourly charges for each provisioned Availability Zone, plus per-GB data processing. |
For S3 or DynamoDB workloads contained in one VPC and Region, a gateway endpoint is usually the straightforward choice if its reach meets your needs. AWS describes gateway endpoints as its recommendation for workloads contained within one account and Region; interface endpoints offer more extensible access. AWS VPC endpoints overview.
Use an interface endpoint when the path must reach beyond the VPC
Gateway endpoints do not provide a route for on-premises clients, peered VPCs in another Region, or traffic traversing a transit gateway. If S3 access must extend to on-premises or connected VPCs, AWS documents an interface endpoint as an option. For DynamoDB and other services, confirm that the required service and Region support the interface endpoint design you need.
Other AWS services require a service-by-service check
Many AWS services offer interface endpoints through PrivateLink, but not every service does, and availability can differ by Region. Check AWS’s current list of AWS services that integrate with AWS PrivateLink before designing around a particular service.
Do VPC endpoints keep AWS traffic off the internet?
An endpoint can let a workload reach a supported AWS service without requiring an internet gateway or NAT device for that service path. Be precise, though: using a public service endpoint does not automatically mean traffic traverses the public internet. AWS explains that a private-subnet instance can route public-endpoint traffic through a NAT gateway and internet gateway while the traffic remains on the AWS network. AWS PrivateLink documentation on endpoint traffic paths.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
An interface endpoint takes a private path through endpoint network interfaces and their private IP addresses. Useful descriptions are “avoids a public internet route” or “does not require an internet gateway or NAT for this service path.” An endpoint alone is not a complete security boundary: authorization, routes, DNS, and network controls still need to be configured correctly.
For S3, check DNS before assuming the gateway endpoint is in use
S3 supports both gateway and interface endpoints, and they can coexist in the same VPC. But DNS and private DNS configuration affect which path a request takes. Depending on the configuration, VPC requests may resolve to and use the billed interface endpoint rather than the no-additional-charge gateway endpoint.
A mixed design can direct on-premises S3 requests through an interface endpoint while VPC-originated requests use the gateway endpoint. AWS documents this configuration and its DNS considerations in Using interface VPC endpoints for Amazon S3.
- After configuring endpoints, verify DNS resolution from the actual clients and subnets.
- Check route tables to confirm the intended VPC traffic uses the gateway endpoint.
- Test both VPC and connected-network access if both are part of the design.
- Plan for connection recovery: AWS warns that endpoint configuration changes can alter routes and disconnect open TCP connections.
Endpoints provide a path, not service permission
A VPC endpoint enables connectivity; it does not grant a user, role, or application permission to call the service. Keep the service’s authorization model—such as IAM permissions and resource policies—in place, and use endpoint policies to constrain requests made through an endpoint. AWS explains these controls in its VPC endpoint access-control documentation.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Additional S3 policy considerations
An S3 bucket policy can restrict access to a specified VPC endpoint using the aws:sourceVpce condition. For requests that traverse a VPC endpoint, AWS says aws:SourceIp is not the appropriate condition for identity or bucket policies; consider aws:VpcSourceIp or suitable route controls instead. An endpoint-only bucket restriction can also block console access for the actions covered by the policy, so account for legitimate console and service access patterns.
Network rules still apply
For gateway endpoint traffic, security-group rules on the instances and subnet network ACLs must allow the required traffic to and from the service. Interface endpoint security groups, endpoint policies, and the service’s own authorization requirements also belong in the design; check the current service-specific requirements rather than assuming they are identical for every endpoint.
Compare endpoint costs with the traffic path you need
Gateway endpoints have no additional endpoint charge. Interface endpoints are billed hourly in each Availability Zone where they are provisioned and per GB of data processed. AWS notes that interface endpoint charges can be lower than equivalent NAT Gateway routing charges, but that is not a universal result. The outcome depends on Region, Availability Zone layout, traffic volume, and current rates. AWS PrivateLink pricing.
Recommended Free Tools
There is no single cost crossover that applies to every architecture. For a real estimate, compare current regional interface-endpoint and NAT Gateway rates using expected traffic volume and the number of endpoint Availability Zones. Include the service and data-transfer charges that apply to either design.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
