Networking
VPC Endpoint vs NAT Gateway
A VPC endpoint privately connects your VPC to AWS services. A NAT Gateway provides outbound internet access from private subnets. They serve different purposes and are often used together in the same VPC.
| Aspect | VPCエンドポイント | NAT Gateway |
|---|---|---|
| Purpose | Private connectivity from VPC to AWS services | Outbound internet access from private subnets |
| Traffic path | Never traverses the internet | Exits to the internet via an Internet Gateway |
| Destination | AWS services (Gateway type: S3/DynamoDB; others: Interface type) | Any destination on the internet |
| Pricing | Gateway type is free; Interface type bills hourly + data processing | Hourly + data processing fees (can get expensive) |
| Security | Reduces attack surface by avoiding the internet | Requires additional security design since it reaches the internet |
How to Choose
Use a Gateway VPC endpoint for private, low-cost access to supported services like S3 and DynamoDB. Use an Interface endpoint (PrivateLink) for private access to most other AWS services. NAT Gateway is the only option when you need to reach destinations outside the VPC (the internet).
Exam Points
- SAA frequently tests "reduce cost of S3 access while keeping it private" → Gateway endpoint
- NAT Gateway cost and comparison with NAT instances (availability, bandwidth, operational overhead) is a recurring topic
- Understanding that Gateway endpoints are controlled via route tables while Interface endpoints use ENIs + security groups is commonly tested
Related Service Guides
References
Last updated: 2026-09-06
This page is created from AWS official documentation and reviewed/edited by the operator. See our editorial & quality policy for details.