EC2 instances in a private subnet access S3.
Avoid NAT Gateway processing charges and keep the path on the AWS network.
Which architecture is most appropriate?
Create an S3 Gateway VPC endpoint and route private-subnet traffic to S3 without a NAT Gateway.
Detailed explanation
This adds unnecessary resources and charges instead of reusing a private endpoint.
This adds unnecessary resources and charges instead of reusing a private endpoint.
A gateway endpoint adds a route from the VPC to S3 without traversing a NAT Gateway.
A gateway endpoint adds a route from the VPC to S3 without traversing a NAT Gateway.
This changes exposure but does not provide the intended private endpoint path.
This changes exposure but does not provide the intended private endpoint path.
DNS resolution alone does not create a network path to S3.
DNS resolution alone does not create a network path to S3.
Check official documentation
Compare the following points with the official documentation.
Amazon S3 Gateway VPC Endpointの公式説明を確認する。
What to confirm
S3向けGateway EndpointとNAT経由の違いを説明できる。
Key points
- Gateway VPC endpoint
- Amazon S3
- NAT Gateway
Notes
- Environment: AWS公式VPC・S3ドキュメントの確認
- Confirm current AWS service behavior and pricing in the official documentation.
Foundation review
Private routing
A gateway endpoint keeps S3 traffic on an AWS-managed private path without NAT processing.
Endpoint versus subnet exposure
Adding an endpoint does not require moving the workload to a public subnet.