By default, if your EC2 instances in a private subnet want to talk to public AWS services like S3 or DynamoDB, traffic must exit through a NAT Gateway to the public internet and re-enter AWS. This adds cost (NAT Gateway charges $0.045/GB processed) and creates an unnecessary exposure surface — your traffic traverses the public internet even though both endpoints are AWS infrastructure.
AWS PrivateLink solves this by keeping traffic entirely within the AWS network backbone. There are two types of PrivateLink endpoints. The older, simpler type is the Gateway Endpoint.
How Gateway Endpoints Work
A Gateway Endpoint is not a device or a network interface — it is a route table target. When you create one, AWS gives you a prefix list ID (e.g., pl-63a5400a for S3 in us-east-1) that represents all the IP ranges for that service. You add a route to your VPC route table:
Destination: pl-63a5400a (S3 prefix list) Target: vpce-0abc123def456789 (Gateway Endpoint)
Traffic destined for S3 now hits this route and is forwarded directly to S3 over the AWS internal network, bypassing the NAT Gateway entirely.
Characteristics of Gateway Endpoints
- Supported Services: Only S3 and DynamoDB. These are the two highest-volume services, which is why AWS made a free, simple endpoint type for them.
- No Private IP: The endpoint does not occupy an IP address in your VPC. It sits at the VPC boundary as a logical routing target.
- Scope: A Gateway Endpoint is associated with specific route tables in a specific VPC. It is not accessible from outside the VPC (e.g., from on-premises via VPN or Direct Connect).
- Cost: Free to create and use. You eliminate NAT Gateway data processing fees for S3 and DynamoDB traffic.
- Access Control: You can attach an endpoint policy (an IAM-style resource policy) to restrict which S3 buckets or DynamoDB tables can be accessed through the endpoint.