All cheat sheets
Networkingcheat sheet

VPC Gateway Endpoints

A free, 60-second route-table change that makes all S3 and DynamoDB traffic from private subnets bypass the NAT Gateway — eliminating $0.045/GB in data processing fees. One of the only pure-savings plays in AWS.

Last reviewed: July 11, 2026

Prefer step by step? Take the guided VPC Gateway Endpoints walkthrough — free, anonymous, interactive.Have an AI assistant? Jump to the copy-paste audit prompt at the bottom of this sheet.

TL;DR: Every S3 GET and DynamoDB call from a private subnet normally flows through your NAT Gateway at $0.045/GB. A Gateway Endpoint adds a route that sends that traffic over AWS's private backbone instead — for free, with no hourly charge, no code changes, and lower latency. Ten TB/month of S3 traffic through NAT is $450/month; through a Gateway Endpoint it's $0. Only two services qualify — S3 and DynamoDB — and that's exactly why this is the first networking fix to make.

The numbers

  • Gateway Endpoint cost: $0. No hourly fee, no per-GB fee — unlike Interface Endpoints ($0.01/h + $0.01/GB).
  • Worked examples from the source workflow: a 50 TB/month ETL pipeline was burning $2,250/month in NAT data processing → $0 (annualized: $27,000); VPC-attached Lambdas pulling 5 TB from S3 saved $225/month and got faster.

Do this

  1. Create the endpoints (60 seconds each):

    aws ec2 create-vpc-endpoint --vpc-id vpc-0abc123 \
  --service-name com.amazonaws.us-east-1.s3 \
  --vpc-endpoint-type Gateway \
  --route-table-ids rtb-11111 rtb-22222

    Repeat with ...dynamodb. Both can coexist in the same VPC.

  2. Associate every route table that matters — this is the step everyone misses. Gateway Endpoints work via route-table entries, not VPC-wide magic. Twenty route tables means twenty associations (or the endpoint silently does nothing for the subnets you skipped).

  3. Verify it's working: NAT Gateway CloudWatch bytes should drop visibly; VPC Flow Logs show traffic hitting the pl- prefix list via the endpoint.

  4. Bake it into IaC so every new VPC ships with both endpoints from day one — set once, save forever.

Gotchas

  • The route-table quirk is the #1 failure: endpoint created, nothing happens, hour of debugging — because it wasn't associated with the private subnets' route tables.
  • IP-based bucket policies break. Policies allowing "our NAT's Elastic IP" stop matching when traffic arrives from the endpoint. Switch to the aws:SourceVpce condition (or IAM-based control).
  • Two services only. Secrets Manager, SQS, ECR, and friends need paid Interface Endpoints — different math, different cheat sheet.
  • Not slower because it's free — you're removing a hop; latency typically improves. Traffic never touches the public internet, which auditors also like.

Skip this if

Almost never — if anything in a private subnet talks to S3 or DynamoDB, this is free money. The only genuine no-op: VPCs whose workloads never touch either service (then your lever is Interface Endpoints for the chatty paid services, or NAT consolidation for everything else).

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are auditing an AWS account for missing VPC Gateway Endpoints. Use
the AWS CLI with READ-ONLY credentials. Do not create, modify, or
delete anything — report findings and recommended (unapplied) fixes
only.

1. Per region in use: aws ec2 describe-vpcs; aws ec2
   describe-vpc-endpoints (note existing Gateway endpoints for
   com.amazonaws.<region>.s3 / .dynamodb and WHICH route tables they're
   associated with); aws ec2 describe-nat-gateways; aws ec2
   describe-route-tables.
2. Findings, in order:
   a. VPC has NAT gateway(s) but NO S3/DynamoDB Gateway Endpoint.
   b. Endpoint exists but is missing from route tables that serve
      private subnets (the classic half-configured case) — compare
      endpoint RouteTableIds against all route tables with a NAT
      default route.
3. Size the prize: CloudWatch NAT BytesOutToDestination per gateway;
   if S3/DDB share is unknown, note it as an upper bound and suggest
   VPC Flow Logs for precision. Savings = S3/DDB GB/mo × $0.045.
4. Policy check: bucket policies using aws:SourceIp pinned to NAT EIPs
   will break when traffic shifts to the endpoint — grep policies of
   the busiest buckets for IP conditions and flag them (fix =
   aws:SourceVpce condition).

Report: per-VPC table (NAT gateways | endpoints present | route tables
covered/missing | est. $/mo saved), the create-vpc-endpoint +
route-table association commands for review — but do NOT execute — and
a note to add endpoints to the IaC template so new VPCs get them
automatically.
Works with any assistant that can run shell commands.

Want the guided version?

The VPC Gateway Endpoints walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough

More Networking cheat sheets

AWS Direct Connect

A dedicated line to AWS drops Data Transfer Out from $0.09/GB to ~$0.02/GB — a 66–75% cut that pays for the port fee many times over at 20+ TB/month of hybrid traffic, and loses money below ~5 TB.

AWS PrivateLink

Interface Endpoints route AWS-service traffic through your VPC privately at $0.01/GB — 4.5× cheaper than NAT Gateway data processing. The payoff is biggest on chatty services: ECR, CloudWatch Logs, Secrets Manager.

AWS WAF Rule Optimization

One rule per blocked IP or bot signature is how teams hit WAF's 1,500-WCU ceiling and a $1/rule/month bill. IP Sets, Regex Pattern Sets, and combined conditions collapse 50 rules into 10 — same protection, 60%+ less capacity and cost.

CloudFront Egress Discounts

Counterintuitive but true: putting CloudFront in front of S3, EC2, or an ALB usually makes the egress bill smaller — CDN transfer rates undercut direct Data Transfer Out, and edge caching removes origin traffic entirely. 30–55% cuts are typical at scale.