A team wants to set up a gateway VPC endpoint so that instances in a private subnet can reach a service without traversing an internet gateway or a NAT device, and without any hourly charge for the endpoint itself. For which AWS services can they actually create a gateway endpoint?
- Any AWS service that offers a VPC interface endpoint, since gateway endpoints and interface endpoints are two names for the same underlying feature
- Amazon S3 only; DynamoDB requires an interface endpoint because it does not support AWS PrivateLink
- Any regional AWS service reachable over HTTPS, since gateway endpoints work generically by routing traffic destined for any AWS-owned IP range
- Only Amazon S3 and Amazon DynamoDB; gateway endpoints are a distinct mechanism from AWS PrivateLink interface endpoints and are limited to these two services
Why D? And why not the others?
Correct answer: D. Only Amazon S3 and Amazon DynamoDB; gateway endpoints are a distinct mechanism from AWS PrivateLink interface endpoints and are limited to these two services
Gateway VPC endpoints are a distinct mechanism from AWS PrivateLink interface endpoints — they don't use AWS PrivateLink at all — and AWS documents that they are supported only for Amazon S3 and Amazon DynamoDB, with no additional hourly charge for the endpoint itself. Every other AWS service that offers private VPC connectivity does so through an interface endpoint (which does use AWS PrivateLink and does carry an hourly charge), not a gateway endpoint. The 'any service with an interface endpoint' option is wrong because it conflates the two endpoint types, which differ in mechanism, pricing, and the specific services they support. The 'S3 only, DynamoDB needs PrivateLink' option is wrong because DynamoDB is one of the two services that specifically supports a gateway endpoint, and it is gateway endpoints, not DynamoDB, that don't use PrivateLink. The 'any regional service over HTTPS' option is wrong because gateway endpoints don't work generically for arbitrary services; they rely on a route added for an AWS-managed prefix list that exists only for the two supported services.
Source: AWS PrivateLink Guide: Gateway endpoints — 'Gateway VPC endpoints provide reliable connectivity to Amazon S3 and DynamoDB... Gateway endpoints do not use AWS PrivateLink... There is no additional charge for using gateway endpoints.'