The newer, more flexible type of PrivateLink is the Interface Endpoint. Where a Gateway Endpoint is a routing trick at the VPC boundary, an Interface Endpoint is an actual network device inside your VPC.
How Interface Endpoints Work
When you create an Interface Endpoint, AWS provisions an Elastic Network Interface (ENI) directly into one of your subnets. This ENI gets a private IP address from your VPC's CIDR range — it looks and behaves like any other network interface in your VPC.
DNS Resolution Magic: AWS automatically creates private DNS entries for the service. When your application calls sqs.us-east-1.amazonaws.com, the DNS query resolves to the private IP of the Interface Endpoint ENI in your subnet — not the public IP on the internet. Your application code requires zero changes.
Before the endpoint exists, that hostname resolves to a public IP (e.g., 52.94.22.10). Once the Interface Endpoint is created with private DNS enabled, the exact same hostname instead resolves to the ENI's private IP inside your VPC (e.g., 10.0.1.237) — a DNS lookup, not a code change, is what redirects the traffic.
Characteristics of Interface Endpoints
- Supported Services: Dozens of AWS services (EC2 API, SNS, SQS, Kinesis, Secrets Manager, SageMaker, and many more) plus AWS Marketplace partner services and your own services exposed via a Network Load Balancer (this is the "PrivateLink for your own services" use case).
- Security: You attach Security Groups to the ENI, giving you fine-grained control over which resources in your VPC can reach the endpoint.
- Accessibility from On-Premises: Unlike Gateway Endpoints, Interface Endpoints can be reached from on-premises networks connected via VPN or Direct Connect, because they have real private IPs that are routable.
- High Availability: Deploy one ENI per Availability Zone for resilience.
- Cost: ~$0.01/hour per endpoint per AZ, plus ~$0.01/GB data processed.
Choosing Between Gateway and Interface Endpoints
| Dimension | Gateway Endpoint | Interface Endpoint |
|---|---|---|
| Services | S3, DynamoDB only | Most AWS services + custom |
| Cost | Free | Hourly + per-GB |
| Private IP in VPC | No | Yes (ENI) |
| Reachable from on-premises | No | Yes |
| Security control | Endpoint policy | Security Groups + endpoint policy |
| DNS changes needed | No | No (automatic with private DNS) |
Key takeaway: Always use Gateway Endpoints for S3 and DynamoDB — they are free and simpler. Use Interface Endpoints for everything else, especially when you need on-premises access to AWS services without traversing the public internet.
A common interview question is: "Your on-premises servers need to call the AWS Secrets Manager API privately, without going over the internet. How do you do it?" The answer requires an Interface Endpoint (not a Gateway Endpoint, which doesn't support on-premises access) with private DNS enabled, connected via Direct Connect or VPN. Interviewers test whether you know the on-premises accessibility distinction between the two endpoint types.