All cheat sheets
Networkingcheat sheet

AWS PrivateLink

Interface Endpoints route AWS-service traffic through your VPC privately at $0.01/GB — 4.5× cheaper than NAT Gateway data processing. The payoff is biggest on chatty services: ECR, CloudWatch Logs, Secrets Manager.

Last reviewed: July 11, 2026

Prefer step by step? Take the guided AWS PrivateLink walkthrough — free, anonymous, interactive.Have an AI assistant? Jump to the copy-paste audit prompt at the bottom of this sheet.

TL;DR: Every byte your private subnets send to AWS services through a NAT Gateway costs $0.045/GB. A PrivateLink Interface Endpoint carries the same traffic for $0.01/GB plus ~$7.30/month per endpoint per AZ — 4.5× cheaper on data, off the public internet entirely. Target the chatty services first (ECR image pulls, CloudWatch Logs, Secrets Manager, SSM); container fleets usually pay back the first month, sometimes eliminating the NAT Gateway altogether.

The numbers

5 TB/month to AWS services:

Path Cost/month
NAT Gateway $32 + 5,000 × $0.045 = $257
PrivateLink $7.30 + 5,000 × $0.01 = $57

Field examples: 200 microservices streaming 8 TB/month of logs — $392 via NAT → $102 with three logs endpoints; a Fargate fleet pulling 2 GB images at deploy/scale — $302 → $104 with ecr.dkr + ecr.api endpoints; an ECS shop dropped its NAT Gateway entirely and saved $3,360/year.

Do this

  1. Pull your NAT data-processing line from Cost Explorer. Rough opportunity ≈ that number × 0.78.

  2. Create endpoints for the chattiest services first — for a container platform that's ecr.api, ecr.dkr, logs, ecs; add secretsmanager/ssm for config-heavy stacks:

    aws ec2 create-vpc-endpoint --vpc-id vpc-0abc123 \
  --vpc-endpoint-type Interface \
  --service-name com.amazonaws.us-east-1.ecr.dkr \
  --subnet-ids subnet-aaa subnet-bbb \
  --security-group-ids sg-0123 --private-dns-enabled

  3. Don't forget the free S3 Gateway Endpoint — ECR stores image layers in S3, so an ECR endpoint without the S3 Gateway Endpoint still leaks layer downloads through NAT.

  4. Verify the NAT drawdown in CloudWatch after each endpoint — bytes should visibly fall; if not, check Private DNS.

  5. Consider endpoint services for your own APIs — publishing internal services via PrivateLink replaces peering meshes and keeps partner/customer traffic private (the standard pattern for regulated SaaS).

Gotchas

  • Private DNS off = paying twice. Apps resolve the public hostname, route through NAT anyway, and you fund both paths. It's the #1 "PrivateLink doesn't work" cause.
  • Per-service, per-AZ fees multiply: 3 services × 3 AZs = 9 × $7.30/month before any data. Only endpoint the AZs you actually run workloads in.
  • Endpoint security groups must allow your resources — forgotten SGs mean 2 AM connection-timeout debugging.
  • Never pay for S3/DynamoDB Interface Endpoints when the free Gateway versions exist.
  • Not every service supports PrivateLink in every region — check before architecting.

Skip this if

  • Volumes are small (under a few hundred GB/month per service) and there's no compliance driver — the per-AZ hourly fees dominate.
  • The traffic is general internet egress — PrivateLink only covers AWS/private-service destinations; that problem is CloudFront or NAT consolidation.
  • S3/DynamoDB are the only heavy targets — the free Gateway Endpoints already cover them.

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are auditing an AWS account for PrivateLink (Interface Endpoint)
savings against NAT Gateway data processing. Use the AWS CLI with
READ-ONLY credentials. Do not create, modify, or delete anything.

1. Baseline: aws ec2 describe-nat-gateways + CloudWatch
   BytesOutToDestination per gateway (30 days) — total NAT-processed
   GB/mo and cost at $0.045/GB.
2. Attribute the chatty services (best-effort): workloads present
   (ECS/EKS clusters → ECR pulls + logs; Lambda-in-VPC; heavy
   CloudWatch Logs ingestion via describe-log-groups storedBytes
   growth). The usual suspects worth endpoints: ecr.api, ecr.dkr,
   logs, secretsmanager, ssm, ecs, monitoring, sqs.
3. Existing endpoints: aws ec2 describe-vpc-endpoints — which of the
   usual suspects already exist, Private DNS enabled?, and which AZs
   (endpoints in AZs with no workloads = waste).
4. Per-candidate math: NAT path (GB × $0.045) vs endpoint path
   (endpoints_per_AZ × $7.30/mo + GB × $0.01). Break-even ≈ 1–2 TB/mo
   per service for a 3-AZ deployment; container fleets usually clear
   it instantly. Remember ECR image layers also need the free S3
   Gateway Endpoint.

Report: NAT-spend baseline, per-service endpoint recommendations with
modeled savings, misconfigurations (missing Private DNS, orphan-AZ
endpoints), and creation commands for review — but do NOT execute
them.
Works with any assistant that can run shell commands.

Want the guided version?

The AWS PrivateLink walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough

More Networking cheat sheets

AWS Direct Connect

A dedicated line to AWS drops Data Transfer Out from $0.09/GB to ~$0.02/GB — a 66–75% cut that pays for the port fee many times over at 20+ TB/month of hybrid traffic, and loses money below ~5 TB.

AWS WAF Rule Optimization

One rule per blocked IP or bot signature is how teams hit WAF's 1,500-WCU ceiling and a $1/rule/month bill. IP Sets, Regex Pattern Sets, and combined conditions collapse 50 rules into 10 — same protection, 60%+ less capacity and cost.

CloudFront Egress Discounts

Counterintuitive but true: putting CloudFront in front of S3, EC2, or an ALB usually makes the egress bill smaller — CDN transfer rates undercut direct Data Transfer Out, and edge caching removes origin traffic entirely. 30–55% cuts are typical at scale.

CloudFront Private Pricing

AWS's worst-kept secret: at 10+ TB/month of CDN egress you can negotiate custom CloudFront rates — typically 20–40% below the public price list — but only if you ask. AWS will never bring it up first.