The Problem
Your EC2 application needs to access an S3 bucket. Traffic must not traverse the internet. You want the simplest, cheapest solution.
The Solution
Set up a gateway VPC endpoint for S3. It is free, requires no ENI, no security group, no NAT gateway — just a route in your route table.
How It Works
Step 1: Create the Endpoint
1
2
3
4
5
aws ec2 create-vpc-endpoint \
--vpc-id vpc-0123456789abcdef0 \
--service-name com.amazonaws.us-east-1.s3 \
--vpc-endpoint-type Gateway \
--route-table-ids rtb-1a rtb-1b rtb-1c
That single command:
- Creates the endpoint
- Adds a route to each route table pointing the S3 prefix list at the endpoint
Route Table Change
Before:
1
2
10.0.0.0/16 → local
0.0.0.0/0 → igw-abcdef (or nothing at all)
After:
1
2
3
10.0.0.0/16 → local
0.0.0.0/0 → igw-abcdef
pl-63a5400a → vpce-0abc123def (S3 prefix list)
Any request to an S3 endpoint (public IP that happens to be in the prefix list) is intercepted and routed to the AWS backbone.
Why This Is Free
Gateway endpoints for S3 and DynamoDB have no hourly charge, no per-GB data processing fee. You only pay the standard S3 storage and request costs. This makes them a no-brainer even if you never planned to enforce private access.
Verification
From an EC2 instance in the VPC:
1
2
3
4
5
# Should resolve S3 to a public IP (but traffic never actually goes public)
nslookup s3.amazonaws.com
# Should succeed without a NAT gateway
aws s3 ls
If the instance has no NAT gateway and no public IP, and aws s3 ls still works, the endpoint is doing its job.
Why Not the Alternatives?
Route 53 private hosted zone — Manages internal DNS. Does not create a network path to AWS services.
NAT gateway — Routes traffic over the public internet via the NAT’s public IP. Fails the requirement, and it costs $0.045/hour + $0.045/GB. Expensive.
Site-to-Site VPN to S3 — VPN connects a VPC to your on-premises network. S3 is not a VPN peer — this makes no sense as an S3 access pattern.
Key Takeaways
- Gateway endpoints for S3 and DynamoDB are free — always create them for VPC-based workloads
- The endpoint is a route in the route table, nothing more
- No ENI, no security group, no ongoing management
- NAT gateway routes to S3 use the public internet — do not confuse it with a private path
- Interface endpoints exist too but cost money; use gateway unless you need on-prem access
Never miss a story from us, subscribe to our newsletter