The Problem
Your containerized application in a VPC transfers 1 TB of data to and from S3 every day. You want to minimize costs and prevent traffic from traversing the internet.
The Solution
Create a gateway VPC endpoint for S3 and associate it with all route tables in the VPC. Zero cost. Zero internet traffic.
How It Works
The Math That Matters
For 1 TB/day (~30 TB/month), here is what each network path costs:
| Path | Endpoint Cost | Data Processing | Monthly Total |
|---|---|---|---|
| Gateway endpoint | $0 | $0 | $0 |
| NAT gateway | ~$32.85 (0.045×730h) | ~$1,350 (30TB × $0.045/GB) | ~$1,383 |
| Interface endpoint | ~$21.90 per AZ | ~$300 (30TB × $0.01/GB) | ~$322 per AZ |
For a multi-AZ setup with interface endpoints, you multiply the AZ costs. NAT is worst. Gateway is free.
Step 1: Create the Endpoint
1
2
3
4
5
aws ec2 create-vpc-endpoint \
--vpc-id vpc-0123456789abcdef0 \
--service-name com.amazonaws.us-east-1.s3 \
--vpc-endpoint-type Gateway \
--route-table-ids $(aws ec2 describe-route-tables --filters Name=vpc-id,Values=vpc-0123456789abcdef0 --query 'RouteTables[].RouteTableId' --output text | tr '\t' ' ')
Associate with all route tables — otherwise pods in different subnets will still hit S3 through the NAT gateway.
Step 2: Optional Endpoint Policy
Restrict which buckets can be accessed:
1
2
3
4
5
6
7
8
9
10
11
{
"Statement": [{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::app-data",
"arn:aws:s3:::app-data/*"
]
}]
}
Anyone using this endpoint can only access the app-data bucket. Attempts to reach other buckets get denied — even if their IAM permissions would otherwise allow it.
What About Intelligent-Tiering or Transfer Acceleration?
These are storage class or network path features — they do not affect whether traffic goes public:
- Intelligent-Tiering = automatic storage class optimization. Purely cost-of-storage. Irrelevant to network path.
- Transfer Acceleration = uses CloudFront edge for faster global uploads. Explicitly uses the public internet. Opposite of what you want.
Neither is a substitute for a VPC endpoint.
Why Not the Alternatives?
Interface endpoint — Works, but costs per AZ per hour plus per-GB data processing. For 1 TB/day, that adds hundreds per month.
S3 Transfer Acceleration — Explicitly designed to speed up traffic over the internet. Directly contradicts the requirement.
S3 Intelligent-Tiering — A storage class feature. Has nothing to do with network paths.
Key Takeaways
- Gateway endpoints for S3 = $0/month regardless of data volume
- Always associate the endpoint with all route tables in the VPC — one missed subnet routes through NAT
- Endpoint policies let you allowlist specific buckets at the network layer
- Transfer Acceleration is public internet — do not confuse with private access
- At 1 TB/day, NAT gateway alone costs ~$1,400/month; gateway endpoint costs $0
Never miss a story from us, subscribe to our newsletter