VPC 端点与私有连接

By default, resources in a private subnet reach AWS services like S3 over the public internet via a NAT gateway. That adds cost, latency, and exposure.

VPC endpoints let traffic stay inside the AWS network.

AWS offers two endpoint types:

• Gateway endpoints — for S3 and DynamoDB (route table based, free)
• Interface endpoints — for most other services (an ENI in your subnet, powered by PrivateLink)

A gateway endpoint adds a route to your route table so S3 traffic never leaves AWS. There is no extra hourly charge.

An interface endpoint creates an elastic network interface with a private IP in your subnet. It is built on AWS PrivateLink.

Use it for services like SQS, SNS, Secrets Manager, and your own services.

You can attach a policy to an endpoint to restrict which actions and resources are allowed through it. This adds a layer of access control beyond IAM.

A NAT gateway lets private subnet instances make outbound internet calls (e.g. to download packages) while blocking inbound connections.

Endpoints reduce, but do not always eliminate, the need for NAT.

Interface endpoints support private DNS. When enabled, the standard service hostname (e.g. secretsmanager.us-east-1.amazonaws.com) resolves to the private endpoint IP automatically.

Interface endpoints have an ENI, so they use security groups. Allow inbound HTTPS (port 443) from the resources that need the endpoint.

PrivateLink also lets you expose your own service to other VPCs or even other AWS accounts without VPC peering, by publishing an endpoint service.

Using endpoints:

• Keeps traffic off the public internet
• Reduces NAT gateway data processing charges
• Lets you apply fine-grained endpoint policies

Decision guide:

• Connecting to S3 or DynamoDB → gateway endpoint
• Connecting to any other AWS service → interface endpoint
• Outbound internet to non-AWS hosts → NAT gateway

You learned about private connectivity:

• Gateway endpoints for S3 and DynamoDB
• Interface endpoints / PrivateLink for other services
• NAT gateways for general outbound internet
• Endpoint policies and security groups control access

Endpoints keep traffic private, cheaper, and more secure.