Cloud egress: VPC endpoints vs NAT Gateway path matrix

VPC gateway endpoints (e.g. S3/DynamoDB) and interface endpoints (PrivateLink) can move AWS-bound traffic off a NAT Gateway — trading NAT hourly/processing/Internet DT-out for endpoint hours, ENI, or private-path fees. Compare stacks with Mode B; keep rates Unknown until verified.

Updated 2026-09-09

Gateway and interface VPC endpoints can shift AWS-bound traffic off NAT — compare endpoint fees to the NAT triple-charge stack.

Path matrix: VPC endpoints vs NAT Gateway (educational)
Path	Meters to model	Best when	FinOps note
Private subnet → NAT → Internet/AWS public	Hourly + processing + Internet DT-out (+ cross-AZ hairpin)	True Internet destinations	Triple-charge pattern
Private subnet → gateway endpoint → S3/DynamoDB	Endpoint policy/ops; often no NAT for that prefix	Heavy AWS-managed object/DB API pulls	Gateway endpoints are prefix-based
Private subnet → interface endpoint → AWS APIs	Endpoint hourly / ENI / PrivateLink-style GB	Private API access without IGW	Per-AZ endpoint sprawl multiplies hours
Public subnet → IGW	Internet DT-out; no NAT processing	Hardened public workloads	Security groups ≠ cost model
Hybrid: endpoints for AWS + NAT for Internet	Both stacks on one bill	Mixed destinations	Split bytes by destination class

Path matrix: VPC endpoints vs NAT Gateway (educational)

Path

Meters to model

Best when

FinOps note

Private subnet → NAT → Internet/AWS public

Hourly + processing + Internet DT-out (+ cross-AZ hairpin)

True Internet destinations

Triple-charge pattern

Private subnet → gateway endpoint → S3/DynamoDB

Endpoint policy/ops; often no NAT for that prefix

Heavy AWS-managed object/DB API pulls

Gateway endpoints are prefix-based

Private subnet → interface endpoint → AWS APIs

Endpoint hourly / ENI / PrivateLink-style GB

Private API access without IGW

Per-AZ endpoint sprawl multiplies hours

Public subnet → IGW

Internet DT-out; no NAT processing

Hardened public workloads

Security groups ≠ cost model

Hybrid: endpoints for AWS + NAT for Internet

Both stacks on one bill

Mixed destinations

Split bytes by destination class

Sources (official AWS docs)

Dated starting points only — Unknown until verified means no invented $/GB. Gateway vs interface coverage lives on this one spoke — no thin duplicate URLs.

This matrix covers both gateway endpoints and interface / PrivateLink-style endpoints versus NAT Gateway on one page — avoiding thin duplicate URLs. For a deeper interface/PrivateLink vs NAT egress bill-line map, open the PrivateLink vs NAT egress spoke. Educational FinOps-lite only; not a broker quote.

Path templates to model

S3 GET via gateway endpoint — often removes NAT for that prefix; still model request ops and any DT nuances.
AWS API via interface endpoint — trades NAT for endpoint hours/ENI/private GB; multiply by AZ count.
Third-party SaaS HTTPS — still needs NAT or equivalent Internet path; endpoints do not cover arbitrary destinations.
Cross-AZ hairpin to a single NAT — adds cross-AZ on top of the triple-charge stack.
Hybrid routing — classify destinations; price endpoint stack and NAT stack as separate lines.

Common traps

Enabling one S3 gateway endpoint and declaring “NAT solved.” Spawning interface endpoints in every AZ “for HA” without measuring bytes. Comparing only Internet $/GB while ignoring NAT hourly. Assuming PrivateLink zeros cross-AZ. No guaranteed savings from endpoint adoption.

FinOps checklist

Export NAT bytes/hours by AZ for 30–90 days; split AWS-bound vs true Internet.
Candidate gateway endpoints for S3/DynamoDB-heavy prefixes.
Candidate interface endpoints only for high-chatter AWS APIs — count AZs.
Model NAT with calculator Mode B; keep endpoint rates Unknown until dated.
Sibling-check NAT vs IGW and the free-tier cliff; read methodology.

Glossary: NAT processing, IGW, path template, VPC endpoint.

FinOps-lite Unknown until verified

Worked example (educational): 1,500 GB AWS-bound via NAT vs endpoint shift

Baseline: 1,500 GB/month S3 API pulls traverse NAT (processing + Internet DT-out) plus 730 NAT hours.

Line NAT hourly — rate Unknown; line NAT processing×1,500 GB — rate Unknown; line Internet DT-out×1,500 GB — rate Unknown.

Candidate shift: gateway endpoint for the S3 prefix — endpoint fee line Unknown (no invented $/GB).

If interface endpoints are needed for other APIs, add per-AZ endpoint hours/ENI — rates Unknown.

Compare stacks with Mode B; do not claim savings without dated cites. Educational only.

Numbered NAT vs endpoint shift — Unknown rate cells
#	Scenario line	Volume	Unit rate
1	NAT hourly (baseline)	730 h	Unknown $/hour
2	NAT processing (baseline)	1,500 GB	Unknown $/GB
3	Internet DT-out (baseline)	1,500 GB	Unknown $/GB
4	Gateway endpoint fees (shift)	same prefix	Unknown
5	Interface endpoint hours (optional)	per AZ	Unknown

FAQ on this path

Do VPC endpoints replace NAT for all traffic?

No. Gateway and interface endpoints cover specific AWS services/prefixes. Arbitrary Internet destinations still need NAT, IGW, or another egress path.

Gateway vs interface — which spoke?

Both live on this matrix. Gateway endpoints are prefix-based (classic S3/DynamoDB); interface endpoints are ENI/PrivateLink-style. PipeToll avoids thin duplicate URLs.

Will endpoints guarantee lower spend?

No. PipeToll never guarantees savings. Measure bytes, AZ count, and dated fees before changing architecture.