- Newest
- Most votes
- Most comments
There are two different endpoint types with different cost models, different reachability, and — critically for your case — a centralized hub pattern adds a second charged hop that a per-VPC gateway endpoint would not have.
1. The two endpoint types
Gateway endpoints — available for Amazon S3 and Amazon DynamoDB.
- Implemented as a route in your route tables.
- No hourly charge and no data processing charge. This is why an S3 gateway endpoint is often described as free.
- They do not extend beyond the VPC boundary. A gateway endpoint cannot be used from another Region, from a peered VPC, over VPN or Direct Connect, or through a Transit Gateway.
Interface endpoints (AWS PrivateLink) — available for a large and growing list of services, including S3 and DynamoDB.
- Provisioned as ENIs in your subnets.
- Charged per hour and per GB of data processed (varies by Region — confirm on the current AWS PrivateLink and Amazon VPC pricing pages).
- Reachable from outside the VPC: on-premises networks, peered VPCs, other Regions, and through a Transit Gateway.
- Support endpoint policies — resource-based policies that control which AWS principals can use the endpoint, usable alongside IAM identity-based policies for defense in depth.
- Throughput: plan for multiple subnets across multiple Availability Zones for high availability; the number of ENIs equals the number of subnets chosen. Inter-AZ data transfer to an interface endpoint is not charged.
2. Why centralizing made your bill go up
In a centralized hub-endpoint architecture, traffic from a spoke VPC has to get to the hub VPC before it reaches the endpoint. That transport is itself charged:
- If spokes reach the hub via Transit Gateway, you pay TGW data processing on that traffic (in addition to the interface endpoint's own data processing charge).
- If spokes reach the hub via VPC peering, there is no charge for data transferred between VPCs in the same Availability Zone, but data transferred across Availability Zones or across Regions is charged.
3. Decision guide
| Situation | Recommended |
|---|---|
| S3 or DynamoDB access from within the VPC, or between VPCs | Gateway endpoint — no hourly or data processing cost |
| S3 or DynamoDB access from on-premises, across Regions, or through a Transit Gateway | Interface endpoint — gateway endpoints cannot serve these paths |
| Any other PrivateLink-supported service | Interface endpoint (only option) |
| You need endpoint policies to restrict which principals may use the endpoint | Interface endpoint |
| High spoke-to-hub volume for S3/DynamoDB | Prefer per-VPC gateway endpoints over a centralized interface endpoint, and reserve centralization for services that have no gateway option |
A reasonable hybrid: keep gateway endpoints in each VPC for S3 and DynamoDB (free, no transport hop), and centralize only the interface endpoints for services where you have no alternative — so the shared transport cost applies to the smallest possible share of traffic.
There are two main types of VPC endpoints with very different cost models:
Gateway VPC Endpoints (S3 and DynamoDB only):
- No hourly charges whatsoever
- No data processing fees
- Completely free to use
- Only support Amazon S3 and Amazon DynamoDB
- This is why you heard the S3 endpoint should be free—Gateway endpoints for S3 eliminate data transfer charges with no added cost
Interface VPC Endpoints (powered by AWS PrivateLink):
- Hourly charge per endpoint per Availability Zone (approximately $0.01/hour/AZ)
- Per-GB data processing charges for traffic flowing through the endpoint
- Support a wide range of AWS services beyond S3 and DynamoDB
Regarding your cost increase after centralizing interface endpoints in a hub VPC, this is actually a common outcome. When you route traffic from spoke VPCs through a centralized hub (typically using Transit Gateway or Cloud WAN), you incur additional charges:
- Per-VPC attachment fees to the hub (hourly charges that accrue even when traffic is light)
- Per-GB data processing charges at the Transit Gateway or routing hub level
- The existing interface endpoint charges (hourly + per-GB processing)
So while you reduced the number of interface endpoints, you added routing infrastructure costs that can exceed the savings, especially with high traffic volumes across many spoke VPCs.
When to use each type:
- Always use Gateway endpoints for S3 and DynamoDB—they're free and eliminate data transfer costs
- Use Interface endpoints for other AWS services when you need private connectivity
- Before centralizing interface endpoints, calculate whether the routing hub costs (attachment fees + data processing) will be less than the cost of duplicating endpoints across VPCs
- Centralization works best cost-wise when you already have the routing hub infrastructure in place for other purposes, so the incremental cost is just the data processing
Sources
When and how to centralize AWS PrivateLink Interface endpoints with Amazon VPC Lattice | Networking & Content Delivery
Reduce unexpected AWS costs: Tracing AWS billing charges with log correlation techniques | Networking & Content Delivery
COST08-BP03 Implement services to reduce data transfer costs - AWS Well-Architected Framework
COST08-BP03 Implement services to reduce data transfer costs - AWS Well-Architected Framework
Relevant content
asked 4 years ago
