A company wants private connectivity from a VPC to Amazon S3 without traversing the internet or a NAT gateway, and wants to avoid any hourly charge for the endpoint itself. Which VPC endpoint type meets this requirement, and how is it implemented?
- Interface endpoint, implemented as an Elastic Network Interface with a private IP in the subnet
- Gateway endpoint, implemented as a target added to the route table, with no hourly charge
- Interface endpoint, which is required for all AWS services including S3
- Gateway endpoint, which requires attaching an Elastic IP for private routing
Correct answer: B. Gateway endpoint, implemented as a target added to the route table, with no hourly charge
S3 and DynamoDB support gateway endpoints, which work by adding a special prefix-list target to the route table entries of the affected subnets; traffic destined for the service's IP ranges routes privately through this target rather than through a NAT gateway or internet gateway, and AWS does not charge an hourly fee for a gateway endpoint. Option A describes an interface endpoint, which does exist for many services and does use an ENI with a private IP, but it bills hourly plus per-GB and is not the mechanism used to keep S3 endpoint access free. Option C is wrong because S3 and DynamoDB specifically support the cheaper gateway model instead of requiring an interface endpoint. Option D is wrong because gateway endpoints work through route table entries, never through an attached Elastic IP, and they never expose any routable public address at all.
Source: AWS PrivateLink docs: Gateway VPC endpoints