EC2 instances in private subnets access S3 heavily in the same Region.
Reduce processing and transfer through a NAT Gateway.
Which design is most appropriate?
An S3 Gateway VPC Endpoint provides a private route from the VPC to S3 and can avoid NAT Gateway processing for that traffic.
Detailed explanation
Public access sacrifices security and is not a safe cost optimization.
Public access sacrifices security and is not a safe cost optimization.
DNS does not remove data-transfer or NAT processing charges.
DNS does not remove data-transfer or NAT processing charges.
A gateway endpoint routes VPC traffic to S3 privately without sending it through a NAT Gateway.
A gateway endpoint routes VPC traffic to S3 privately without sending it through a NAT Gateway.
NAT processing adds cost and is unnecessary for the supported S3 endpoint path.
NAT processing adds cost and is unnecessary for the supported S3 endpoint path.
Check official documentation
Compare the following points with the official documentation.
Amazon S3 Gateway VPC Endpointとルートテーブルの公式説明を確認する。
What to confirm
同一リージョンのS3アクセス経路をVPC Endpointへ変更できる。
Key points
- Gateway VPC Endpoint
- NAT Gateway
- Private S3 access
Notes
- Environment: AWS公式VPC・S3ドキュメントの確認
- Confirm current AWS pricing and service behavior in the official documentation.
Foundation review
Path selection
A gateway endpoint is a service-specific path and can avoid the per-byte NAT processing charge.
Security boundary
Private routing does not require making the bucket publicly accessible.