VPC gateway vs interface endpoint cost: free vs per-hour PrivateLink

Quick answer

AWS has two VPC endpoint types with very different pricing. Gateway endpoints, available only for S3 and DynamoDB, are completely free: no hourly fee, no data processing charge. Interface endpoints (powered by PrivateLink) cost about $0.01 per hour per endpoint per availability zone, roughly $7.30 per month per AZ, plus about $0.01 per GB of data processed. So an interface endpoint spread across three AZs costs around $22 per month before traffic. The cost lesson: always use the free gateway endpoint for S3 and DynamoDB, and count the per-AZ hourly fee before adding interface endpoints for every other service.

VPC endpoints let resources reach AWS services without going through a NAT Gateway or the public internet, which saves on NAT processing and data transfer. But the two endpoint types price very differently, and the difference between free and per-hour-per-AZ is large enough that mixing them up can quietly inflate a bill.

The two endpoint types

Factor	Gateway endpoint	Interface endpoint
Services	S3 and DynamoDB only	Most other AWS services
Hourly fee	Free	~$0.01/hr per AZ (~$7.30/mo)
Data processing	Free	~$0.01/GB
Technology	Route table entry	PrivateLink elastic network interface

Gateway endpoints work by adding a route in your route table that sends S3 or DynamoDB traffic over AWS's private network. They cost nothing: no hourly charge, no per-GB fee. Interface endpoints place an elastic network interface in each subnet you enable, using PrivateLink, and bill about $0.01 per hour for each one in each availability zone plus about $0.01 per GB processed.

Where the interface fee adds up

The per-AZ pricing is the part people miss. An interface endpoint enabled in three availability zones for high availability costs about $0.03 per hour, roughly $22 per month, before any data. Enable a dozen interface endpoints (say for SSM, ECR, CloudWatch Logs, KMS, Secrets Manager, and more) across three AZs and you are near $260 per month in hourly fees alone. That can rival or exceed the NAT Gateway you were trying to avoid, so the endpoints are only worth it when they displace enough NAT processing and data transfer to pay for themselves.

The free win you should always take

Because gateway endpoints for S3 and DynamoDB are free, there is essentially never a reason not to use them. They remove S3 and DynamoDB traffic from your NAT Gateway, cutting the $0.045 per GB NAT processing fee to zero for that traffic, at no cost. For a data-heavy workload reading terabytes from S3 through a NAT Gateway, adding the free gateway endpoint can save hundreds of dollars a month instantly. This is the single highest-return change in VPC networking cost.

Deciding on interface endpoints

For interface endpoints, weigh the per-AZ hourly fee against the NAT processing and data transfer they remove. If a service handles heavy traffic through NAT, the endpoint pays for itself. If it is light, the endpoint may cost more than the NAT traffic it replaces. Consider enabling interface endpoints in fewer AZs where full redundancy is not required, and centralizing shared endpoints as thePrivateLink cost guide describes. Compare the whole picture against a plain NAT Gateway to see which is cheaper for your mix.

Endpoint fees are easy to overlook until a dozen of them across three AZs appear on the bill. Price your VPC endpoint design against the resource catalog so the free wins are taken and the per-AZ interface fees are counted before you build the network.

FAQ

What is the difference between gateway and interface VPC endpoints?

Gateway endpoints, available only for S3 and DynamoDB, add a route to your route table and are completely free. Interface endpoints, powered by PrivateLink, place an elastic network interface in each enabled subnet for most other AWS services and cost about $0.01 per hour per availability zone plus about $0.01 per GB processed. The pricing gap between free and per-AZ-per-hour is the key distinction.

How much do interface endpoints cost?

About $0.01 per hour per endpoint per availability zone, roughly $7.30 per month per AZ, plus about $0.01 per GB of data processed. An interface endpoint across three AZs costs about $22 a month before traffic. A dozen interface endpoints across three AZs approaches $260 a month in hourly fees alone, which can rival the NAT Gateway they were meant to replace.

Are S3 and DynamoDB VPC endpoints free?

Yes. Gateway endpoints for S3 and DynamoDB have no hourly fee and no data processing charge. They route that traffic over AWS's private network and remove it from your NAT Gateway, cutting the $0.045 per GB NAT processing fee to zero for S3 and DynamoDB traffic. There is essentially no reason not to use them, and for data-heavy S3 workloads they can save hundreds a month instantly.

Are interface endpoints worth the cost?

Only when they displace enough NAT processing and data transfer to pay for their per-AZ hourly fee. If a service handles heavy traffic through NAT, an interface endpoint that removes the $0.045 per GB NAT charge can pay for itself. If the traffic is light, the endpoint may cost more than the NAT traffic it replaces. Enabling them in fewer AZs or centralizing shared endpoints reduces the fee.

How can I reduce VPC endpoint cost?

Always use the free gateway endpoints for S3 and DynamoDB. For interface endpoints, enable only the ones whose traffic justifies the per-AZ fee, consider fewer availability zones where full redundancy is not required, and centralize shared interface endpoints in a shared-services VPC accessed via Transit Gateway or peering rather than duplicating them in every VPC.

How does C3X help with VPC endpoint cost?

C3X prices your gateway and interface endpoints from Terraform before you deploy, so the per-AZ hourly fees and the NAT savings they create are both visible in the pull request. That lets you confirm the free S3 and DynamoDB gateway endpoints are in place and check that each interface endpoint actually pays for itself, at design time rather than after a dozen of them land on the bill.

What to do next

Price your VPC endpoints before you deploy them. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.