← Back to context

Comment by otterley

5 days ago

Gateway endpoints are free. Network endpoints (which are basically AWS-managed ENIs that can tunnel through VPC boundaries) are not free.

S3 can use either, and we recommend establishing VPC Gateway endpoints by default whenever you need S3 access.

(Disclaimer: I work for AWS, opinions are my own.)

11 comments

otterley

Reply
JoshTriplett  5 days ago

That's fascinating! I hadn't found that in the documentation; everything seems to steer people towards PrivateLink, not gateway endpoints.

Would you recommend using VPC Gateway even on a public VPC that has an Internet gateway (note: not a NAT gateway)? Or only on a private VPC or one with a NAT gateway?

  • otterley  5 days ago

    I recommend S3 Gateways for all VPCs that need to access S3, even those that already have routes to the Internet. Plus they eliminate the need for NAT Gateway traversal for requests that originate from private subnets.

    • JoshTriplett  5 days ago

      > I recommend S3 Gateways for all VPCs that need to access S3, even those that already have routes to the Internet.

      Fascinating. What's the advantage of doing that?

      2 replies →

  • paulddraper  5 days ago

    > everything seems to steer people towards PrivateLink, not gateway endpoints

    Gateway endpoints only work for some things.

  • Hikikomori  5 days ago

    Privatelink endpoints can be of type gateway or interface. Only gateway is free and only S3 and dynamodb supports it.

kbolino  5 days ago

Fair point, and valid for S3 (the topic at hand) and DynamoDB.

Other AWS services, though, don't support gateway endpoints.