Bypassing the NAT for S3 and DynamoDB
AWS recognized that charging customers $0.045/GB to move data between their own services was creating perverse incentives and architectural anti-patterns. Their solution for the two most commonly accessed services — S3 (object storage) and DynamoDB (NoSQL database) — is the Gateway VPC Endpoint.
A Gateway Endpoint is not a piece of hardware or a proxy. It is a routing rule added to your VPC's Route Table. The route table is the lookup table your VPC uses to decide where to send traffic. The Gateway Endpoint adds an entry that says:
"Traffic destined for S3's IP ranges? Do not send it to the NAT Gateway. Send it directly to S3 via AWS's internal network."
The traffic never leaves AWS's private backbone. It never touches the NAT Gateway. It never incurs data processing fees.
Cost: Free. No hourly fee. No per-GB fee. Zero.
Creating a Gateway Endpoint for S3 in a VPC takes about 30 seconds in the AWS console, or a single Terraform resource specifying which VPC it belongs to, which service it points at, and which route tables it should modify. After applying it, all S3 traffic from your private subnets routes through the endpoint automatically. No application changes required. No restarts. The routing table update is transparent to your application.
The Architectural Principle: Every VPC you build should have Gateway Endpoints for S3 and DynamoDB enabled by default. There is no trade-off to evaluate. There is no scenario where routing S3 traffic through a NAT Gateway is preferable to using the free Gateway Endpoint. Treat it as a mandatory baseline configuration, like enabling VPC Flow Logs or tagging resources.
A common interview question is: "What's the difference between a Gateway Endpoint and an Interface Endpoint?" The key distinctions are: Gateway Endpoints are free and only support S3 and DynamoDB; they work by modifying route tables. Interface Endpoints (PrivateLink) cost money, support hundreds of services, and work by placing an ENI (Elastic Network Interface — a virtual network card) with a private IP directly in your subnet. Confusing these two is a red flag in a cloud architecture interview.