If you’re running EC2 instances or Lambda functions in private subnets, they may still need to reach services such as Amazon S3, Amazon ECR, and Amazon CloudWatch. A common setup sends that traffic through a NAT Gateway. It works, but it can add charges you didn’t expect.
A NAT Gateway has an hourly charge and a per-GB data processing charge. When traffic to supported AWS services passes through it, those processing charges can add up even though you’re accessing AWS services.
Where VPC endpoints help
A VPC endpoint lets resources in your VPC reach a supported service without routing that traffic through a NAT Gateway. There are two useful types:
- Gateway endpoints support Amazon S3 and DynamoDB. There’s no additional hourly or data processing charge for the endpoint itself. If your workloads access S3 through a NAT Gateway, an S3 gateway endpoint is a good first place to look.
- Interface endpoints support services including Amazon ECR and CloudWatch. They have hourly charges per Availability Zone and data processing charges, so adding one does not automatically save money. Check which services your workload uses, how much traffic goes to each, and the endpoint charges in your Region before deciding.
VPC endpoints don’t replace every use of a NAT Gateway. Your workloads may still need one for other outbound traffic. The goal is simpler: identify traffic that can use a gateway or interface endpoint, then compare the costs before changing your network design.
