Private Access to Cloud Services

The problem

Cloud services such as S3, Azure Storage or Google Cloud Storage have public endpoints. From a private subnet, traffic to them normally goes through the NAT gateway: you pay NAT data-processing charges, and the traffic leaves your network.

Private options

With interface endpoints, the service gets a private IP in your subnet, and private DNS makes the normal service name (sqs.eu-west-1.amazonaws.com) resolve to it, so applications don't change.

NAT_PER_GB = 0.045          # example NAT gateway data-processing price in USD per GB
INTERFACE_PER_GB = 0.01     # example interface endpoint data price in USD per GB
monthly_gb = 20_000         # backups and logs to S3

print(f"via NAT gateway:        ${monthly_gb * NAT_PER_GB:>5,.0f} per month")
print(f"via interface endpoint: ${monthly_gb * INTERFACE_PER_GB:>5,.0f} per month (plus hourly endpoint fees)")
print(f"via gateway endpoint:   ${0:>5,.0f} per month (S3 and DynamoDB only)")

via NAT gateway:        $  900 per month
via interface endpoint: $  200 per month (plus hourly endpoint fees)
via gateway endpoint:   $    0 per month (S3 and DynamoDB only)

Why it matters

• Security: data never crosses the internet, and endpoint policies can limit which buckets or accounts are reachable (stopping data exfiltration to someone else's bucket).
• Cost: heavy S3 traffic through a NAT gateway is expensive; a gateway endpoint is free.
• Overlapping ranges: PrivateLink connects a consumer to a service even when their networks overlap, because only one IP is exposed.