Paying for Privacy on Everything Else
Gateway Endpoints solve the S3 and DynamoDB problem for free. But what about the hundreds of other AWS services your application might call — Secrets Manager, SQS, ECR, Kinesis, CloudWatch, Systems Manager — or even third-party SaaS APIs accessed via PrivateLink?
For these, AWS offers Interface VPC Endpoints, built on a technology called AWS PrivateLink.
An Interface Endpoint works differently from a Gateway Endpoint. Instead of modifying a route table, it creates an ENI (Elastic Network Interface) — a virtual network card — with a private IP address directly inside your subnet. When your application calls kinesis.us-east-1.amazonaws.com, DNS resolves that hostname to the private IP of the ENI in your subnet. Traffic flows from your app to the ENI, then through AWS's private backbone to the service — never touching the NAT Gateway or the public internet.
Cost Structure:
| Component | NAT Gateway | Interface Endpoint |
|---|---|---|
| Hourly fee | ~$0.045/hr (~$32/mo) | ~$0.01/hr (~$7/mo) per AZ |
| Data processing | $0.045/GB | ~$0.01/GB |
The Math for a High-Volume Service:
Suppose your application sends 10 TB/month to AWS Kinesis (a real-time data streaming service):
- Via NAT Gateway: 10,000 GB × $0.045 = $450/month
- Via Interface Endpoint: (10,000 GB × $0.01) + $7 = $107/month
- Savings: ~$343/month, or roughly 76% reduction in data transfer costs for this flow
The Interface Endpoint is not free, but for any service with meaningful traffic volume, it is almost always cheaper than routing through a NAT Gateway. The hourly fee is the fixed cost you pay to avoid the higher per-GB NAT processing fee.
One important operational detail: Interface Endpoints are per-AZ. If you have three Availability Zones and want zone-local traffic (avoiding cross-AZ hops to reach the endpoint), you need one endpoint per AZ. This triples the hourly cost but eliminates cross-AZ charges for endpoint traffic — another break-even calculation to run based on your traffic volume.