VPC Endpoints and Private Connectivity
Learn how to connect to AWS services privately without traversing the public internet using VPC endpoints, PrivateLink, and NAT gateways.
VPC Endpoints and Private Connectivity is a free AWS for Backend Developers (EC2, S3, RDS, Lambda) lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the AWS for Backend Developers (EC2, S3, RDS, Lambda) learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
The Problem with Public Traffic
By default, resources in a private subnet reach AWS services like S3 over the public internet via a NAT gateway. That adds cost, latency, and exposure.
VPC endpoints let traffic stay inside the AWS network.
Two Kinds of Endpoints
AWS offers two endpoint types:
- Gateway endpoints — for S3 and DynamoDB (route table based, free)
- Interface endpoints — for most other services (an ENI in your subnet, powered by PrivateLink)
Gateway Endpoint for S3
A gateway endpoint adds a route to your route table so S3 traffic never leaves AWS. There is no extra hourly charge.
aws ec2 create-vpc-endpoint \
--vpc-id vpc-123 \
--service-name com.amazonaws.us-east-1.s3 \
--route-table-ids rtb-456Interface Endpoints and PrivateLink
An interface endpoint creates an elastic network interface with a private IP in your subnet. It is built on AWS PrivateLink.
Use it for services like SQS, SNS, Secrets Manager, and your own services.
aws ec2 create-vpc-endpoint \
--vpc-id vpc-123 \
--vpc-endpoint-type Interface \
--service-name com.amazonaws.us-east-1.secretsmanager \
--subnet-ids subnet-789Endpoint Policies
You can attach a policy to an endpoint to restrict which actions and resources are allowed through it. This adds a layer of access control beyond IAM.
NAT Gateways Recap
A NAT gateway lets private subnet instances make outbound internet calls (e.g. to download packages) while blocking inbound connections.
Endpoints reduce, but do not always eliminate, the need for NAT.
DNS Resolution for Endpoints
Interface endpoints support private DNS. When enabled, the standard service hostname (e.g. secretsmanager.us-east-1.amazonaws.com) resolves to the private endpoint IP automatically.
Security Groups on Endpoints
Interface endpoints have an ENI, so they use security groups. Allow inbound HTTPS (port 443) from the resources that need the endpoint.
Cross-VPC Connectivity
PrivateLink also lets you expose your own service to other VPCs or even other AWS accounts without VPC peering, by publishing an endpoint service.
Cost and Security Benefits
Using endpoints:
- Keeps traffic off the public internet
- Reduces NAT gateway data processing charges
- Lets you apply fine-grained endpoint policies
Choosing the Right Endpoint
Decision guide:
- Connecting to S3 or DynamoDB → gateway endpoint
- Connecting to any other AWS service → interface endpoint
- Outbound internet to non-AWS hosts → NAT gateway
Quick Check
Test your connectivity knowledge.
Recap
You learned about private connectivity:
- Gateway endpoints for S3 and DynamoDB
- Interface endpoints / PrivateLink for other services
- NAT gateways for general outbound internet
- Endpoint policies and security groups control access
Endpoints keep traffic private, cheaper, and more secure.
Frequently asked questions
Is the “VPC Endpoints and Private Connectivity” lesson free?
Yes — the full text of “VPC Endpoints and Private Connectivity” is free to read here on the web, and the AWS for Backend Developers (EC2, S3, RDS, Lambda) course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the AWS for Backend Developers (EC2, S3, RDS, Lambda) course, upgrade to CoddyKit PRO.
What will I learn in “VPC Endpoints and Private Connectivity”?
Learn how to connect to AWS services privately without traversing the public internet using VPC endpoints, PrivateLink, and NAT gateways. You practise AWS for Backend Developers (EC2, S3, RDS, Lambda) with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start AWS for Backend Developers (EC2, S3, RDS, Lambda)?
No prior experience is required. AWS for Backend Developers (EC2, S3, RDS, Lambda) on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “VPC Endpoints and Private Connectivity” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this AWS for Backend Developers (EC2, S3, RDS, Lambda) lesson?
Yes. Every AWS for Backend Developers (EC2, S3, RDS, Lambda) lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- VPC, Subnets, and Route Tables
- Security Groups and NACLs
- IAM Roles and Policies
- VPC Endpoints and Private Connectivity