# Missing VPC endpoints for high-volume AWS service access Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/missing-vpc-endpoints-for-high-volume-aws-service-access When EC2 instances, Lambda functions, or containerized workloads in private subnets access AWS-managed services without VPC Endpoints, that traffic... By: Trig Ghosh Updated: 2026-09-28 [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) # Missing VPC Endpoints for High-Volume AWS Service Access The short version When EC2 instances, Lambda functions, or containerized workloads in private subnets access AWS-managed services without VPC Endpoints, that traffic typically reaches the service's public endpoint through a NAT Gateway, and every GB incurs NAT Gateway data processing charges, even when the service is in the same Region. Trig Ghosh AWS service [AWS VPC](https://www.pointfive.co/efficiency-hub/cloud-services/aws-vpc) Category [Networking](https://www.pointfive.co/efficiency-hub/service-category/networking) Reference CER-0118 Type Inefficient Architecture ## Explanation Why the waste happens and who it affects. This adds up quickly for data-intensive or high-frequency workloads. Gateway endpoints for S3 and DynamoDB carry no charge, while interface endpoints have their own hourly per-AZ and per-GB charges, so they pay off only when the NAT processing they replace is larger. ## Billing model The pricing dimensions that drive this cost. - NAT Gateway: billed for each NAT Gateway-hour (partial hours are billed as full hours) plus a data processing charge for every GB processed, regardless of source or destination; in US East (Ohio), for example, the rates are $0.045 per hour and $0.045 per GB. Standard data transfer charges also apply. - Gateway endpoints (Amazon S3 and DynamoDB only): no hourly or data processing charges, so routing that traffic through them removes the NAT data processing charge for it. - Interface endpoints (AWS PrivateLink): billed per VPC endpoint per Availability Zone for every hour the endpoint is provisioned, regardless of traffic, plus a per-GB data processing charge tiered by the total processed across all interface endpoints in the Region. - Data transfer between EC2 and S3 in the same Region has no data transfer charge whether it passes through a NAT Gateway or an endpoint; the saving this inefficiency targets is the NAT Gateway data processing charge. ## How to detect 5 checks to find it in your estate. - Review VPC architecture for services that communicate with S3, DynamoDB, Secrets Manager, or other AWS-managed APIs - Check whether Gateway Endpoints for S3 and DynamoDB exist and are attached to relevant route tables - Identify missing Interface Endpoints for high-traffic services like Secrets Manager, SSM, or KMS - Analyze NAT Gateway metrics (bytes processed per destination service) to quantify potential endpoint-eligible traffic - Correlate NAT Gateway charges with known service access patterns to surface reroutable costs ## How to fix 5 ways to remove the waste. - Provision Gateway Endpoints for S3 and DynamoDB in each VPC that accesses those services - Create Interface Endpoints (via AWS PrivateLink) for services with enough NAT Gateway traffic that the NAT processing charges saved exceed the endpoint's hourly per-AZ and per-GB charges, or where private access is required (e.g., Secrets Manager, CloudWatch Logs) - Ensure routing tables and DNS settings support private resolution to AWS services - Embed VPC endpoint provisioning into infrastructure-as-code templates to ensure consistency across accounts and regions - Monitor NAT Gateway data transfer volume over time to verify cost reduction after endpoint rollout ## Documentation Vendor references for pricing and configuration. - [Gateway endpoints - Amazon Virtual Private Cloud docs.aws.amazon.com](https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html) - [Access an AWS service using an interface VPC endpoint - Amazon Virtual Private Cloud docs.aws.amazon.com](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html) - [Amazon VPC Pricing aws.amazon.com](https://aws.amazon.com/vpc/pricing/) - [AWS PrivateLink Pricing aws.amazon.com](https://aws.amazon.com/privatelink/pricing/) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - AWS VPC CER-0038 ### [Inactive VPC Interface Endpoint](https://www.pointfive.co/efficiency-hub/inefficiencies/inactive-vpc-interface-endpoint) VPC Interface Endpoints are commonly deployed to meet network security or compliance requirements by enabling private access to AWS services. However, these endpoints often remain provisioned even after the original use case is deprecated.... Networking - AWS VPC CER-0349 ### [Unnecessary Public IPv4 Addresses on In-Use Resources](https://www.pointfive.co/efficiency-hub/inefficiencies/unnecessary-public-ipv4-addresses-on-in-use-resources) Since February 1, 2024, AWS charges an hourly fee for every public IPv4 address, whether it is idle or attached to a running resource. Many resources still receive public addresses they never use: default subnets and subnets with... Networking - AWS NAT Gateway CER-0325 ### [Excessive NAT Gateway Data Processing Charges from Unoptimized Traffic Routing](https://www.pointfive.co/efficiency-hub/inefficiencies/excessive-nat-gateway-data-processing-charges-from-unoptimized-traffic-routing) NAT Gateway charges a per-gigabyte data processing fee on all traffic that passes through it - in either direction - regardless of whether the destination is the public internet or another AWS service in the same region. This per-GB charge... Networking --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.