AWS VPC Endpoints | Deep Dive & Hands-On.

AWS VPC Endpoints - Deep Dive & Hands-On.

Scope:

• The concept of  VPC Endpoint
• Types of VPC Endpoints (three types of VPC endpoints) Description & Use Cases,
• Architecture Overview,
• How VPC Endpoints Work,
• Security Layers & Purposes,
• Sample Endpoint Policy that restrict S3 to one specified bucket,
• A sample S3 bucket policy that narrows-down allow to a specific file within a specific Bucket,
• Traffic Flow Sample for Interface Endpoint,
• Pricing & Costs Structure,
• Best Practices for VPC Endpoints, 
• VPC Endpoints vs Alternatives,
• Common Use Cases for VPC Endpoints,
• Project: Hands-On.

The concept of VPC Endpoint

•  A VPC Endpoint allows twtech VPC to privately connect to AWS services without traversing the public internet.
•  VPC Endpoint Traffic stays entirely within the AWS private network.
• Think of VPC Endpoint as a private on-ramp from twtech VPC to AWS services such as S3, DynamoDB, or custom services powered by PrivateLink.

 Types of VPC Endpoints (three types of VPC endpoints) Description & Use Cases:

Type	Description	Uses AWS PrivateLink?	Typical Use Case
Gateway Endpoint	Targeted to a route table; used for S3 and DynamoDB	❌ No	Access S3/DynamoDB privately
Interface Endpoint	ENI (Elastic Network Interface) with a private IP	✅ Yes	Connect to most AWS or third-party services privately
Gateway Load Balancer Endpoint (GWLBe)	Used for traffic inspection / third-party appliances	✅ Yes	Network security appliances, firewalls, etc.

 Architecture Overview

 1. Gateway Endpoint (S3/DynamoDB)

• Added as a target in your route table.
• Routes specific service traffic (e.g. s3.amazonaws.com) to the endpoint.
• No additional ENIs created.
• Free to use (no hourly cost).

2. Interface Endpoint (PrivateLink)

• Creates an Elastic Network Interface (ENI) in your subnet.
• Has a private IP address that connects to the AWS service.
• Each service is mapped to a DNS entry that resolves to the private IP.
• Billing: per-hour + per-GB data processing charge.

 3. Gateway Load Balancer Endpoint

• Used for service chaining, like sending all outbound traffic through a firewall appliance.
• Combines features of PrivateLink with load balancing and network inspection.

How VPC Endpoints Work

1. DNS Redirection
• AWS automatically updates DNS records for services like s3.amazonaws.com to resolve to the private IP inside twtech VPC.
• twtech must enable:
• enableDnsHostnames
• enableDnsSupport
2. Private Connectivity
• No NAT Gateway or Internet Gateway required.
• Traffic never leaves the AWS network.
3. Security
• Endpoint policies define which resources can be accessed through the endpoint.
• Can combine with IAM and bucket policies for fine-grained control.

 Security Layers & Purposes

Layer	Purpose
Endpoint Policy	JSON-based IAM policy restricting access via the endpoint
Security Groups	For Interface Endpoints (controls inbound/outbound)
NACLs	Network-level filtering
IAM Policy / Resource Policy	Controls what actions are allowed on target service

#Sample Endpoint Policy that restrict S3 to one specified bucket:

# json

{

  "Statement": [

    {

      "Effect": "Allow",

      "Principal": "*",

      "Action": "s3:*",

      "Resource": ["arn:aws:s3:::twtech-secure-bucket/*"]

    }

  ]

}

 # A sample S3 bucket policy that narrows-down allow to a specific file within a specific Bucket.

# json

{

  "Statement": [

    {

      "Effect": "Allow",

      "Principal": "*",

      "Action": "s3:*",

      "Resource": ["arn:aws:s3:::twtech-secure-bucket/twtech-logs"]

    }

  ]

}

Traffic Flow Sample for Interface Endpoint

NB:

• All traffic stays within AWS’s private backbone network.

 Pricing & Costs Structure.

Type	Cost Structure
Gateway Endpoint	Free (no hourly or data charge)
Interface Endpoint	Per-hour + per-GB processed
GWLBe	Per-hour + per-GB processed

 Best Practices for VPC Endpoints 

✅    Use Gateway Endpoints for S3/DynamoDB to reduce NAT data transfer cost
✅    Use Interface Endpoints for private access to critical services (e.g. SSM, Secrets Manager)
✅    Enable Private DNS for seamless service access
✅    Restrict Endpoint Policies to least privilege
✅    Monitor via CloudWatch + VPC Flow Logs
✅    Avoid open Security Groups on Interface Endpoints

 VPC Endpoints vs Alternatives

Feature	VPC Endpoint	NAT Gateway	Transit Gateway
Public Internet Required	❌	✅	Optional
Private AWS Access	✅	❌	✅
Cost Efficiency (for AWS traffic)	✅	❌	⚙️ Depends
Supports Third-Party Services	Interface/GWLB only	❌	✅

 Common Use Cases for VPC Endpoints 

• Access S3 privately from a private subnet
• Use AWS Systems Manager (SSM) Session Manager without internet access
• Connect to Secrets Manager or ECR API from private instances
• Route all outbound traffic through a security appliance via GWLB Endpoint

Project: Hands-On

• How twtech use VPC Endpoints to privately connect to AWS services without traversing the public internet.

Search for AWS service: VPC

Step-1

• SSH (connect) to Bastion Host Instance from any terminal already configure: twtech is using EC2 instance connect for this Project.

• From Bastion Host Instance, connect into the Private EC2 instance in the VPC (twtechVPC)
•  How twtech access S3 buket from Private instance:twtechs3

Step-2:

•     Create a role for the Private instance in the VPC.
•     Select the instance and navigate to Security tab

• Modify the IAM Role for the Private Instance:

• Create a Role:

 

Select trusted entity (Role Type): Trusted entity type

Role is for: EC2 instances

Add permissions

Name, review, and create

Step 1 & 2:

Step 2: Add permissions

Create role:

Step-3

• Return to IAM console, refresh and add update Persmission:

Step-4

• Return to Private Instance terminal to make API calls for S3 with command.

aws s3 ls

Other commands to test connect:

ping think-with-tech.blogspot.com

curl google.com

• How twtech connects to the Private instance with VPC endpoints with Internet Gateway: with VPC Interface Endpoint

Step-5:

•      Edit the Rout Table of the Private Subnet to remove Internet Gateway.

From: Local Connection & NAT Gateway Present

To : Local  Connection Only (remove the Nat Gateway)

Save changes:

Step-6

• twtech has just effectivtely preventing the Private instance from access the internet
• ·       Verify if the Private instance has internet again:

Step-7:

• How twtech eventually connects to S3 service via the VPC endpoint:
• From VPC console: Create a VPC endpoint Service

Create endpoint Service: Interface Endpoint Service

• Create the type of VPC endpoint that supports the service, service network or resource to which twtech wants to connect.

Services

Network settings: Select the VPC in which to create the endpoint.
PrivateDNS Name: Enable

• twtech needs to choose the AZ where Endpoint would be deployed: then associate them subnets

Select the Security group to attach the Endpoint:

Create endpoint:

• Instead of interface Endpoint, twtech may decide to create a VPC Gateway Endpoint.

Step-by-step:

Network settings

• Route tables: Select the route to update, so requests are sent through it: Private Route Table (twtechPrivateRT)

Policy: full Access

Create endpoint:

What exactly is happening behind the Scenes:

·       An endpoint is created and associate with the Private Route table

More detail can be got via the associated route table: twtechPrivateRT

twtech Explanation:

•     Some of the traffic will be directed via the Private route table to VPC endpoints

Step-8:

Finally:

• twtech needs to verify whether VPC endpoint Gateway created provides service access to the Private instance with the command.
• Again, there in no internet service in the private instance. Nat Gateway has been removed.

aws s3 ls

How twtech lists endpoint to specific regions: filfter commands with flags

aws s3 ls --region us-east-2