After creating a gateway VPC endpoint for Amazon S3, instances in a subnet still cannot use it to reach S3 privately, even though the endpoint itself shows as available. What is the most likely missing step?
- The subnet's route table was never associated with (selected for) the gateway endpoint, so it never received the automatically-added route that points the S3 prefix list at the endpoint
- The subnet's security group was never updated to allow inbound traffic from the gateway endpoint's private IP address
- The gateway endpoint was never given an Elastic IP address to act as its entry point
- The VPC's enableDnsHostnames attribute was never enabled, which is required for any gateway endpoint to receive traffic
Why A? And why not the others?
Correct answer: A. The subnet's route table was never associated with (selected for) the gateway endpoint, so it never received the automatically-added route that points the S3 prefix list at the endpoint
When you create a gateway endpoint, AWS only adds the routing entry (destination is the service's prefix list, target is the endpoint) to the specific route tables you selected for that endpoint; a route table you didn't select never receives this route, so any subnet using that unselected route table still sends S3-bound traffic to whatever other route (or no route) it already had, and never reaches the endpoint. Selecting the correct route table for the subnet is therefore the fix. The security group option is wrong because gateway endpoints don't have their own private IP address or elastic network interface the way interface endpoints do — traffic still uses the service's public endpoint address space, so there is no endpoint-side network interface for a security group to filter. The Elastic IP option is wrong for the same structural reason: a gateway endpoint isn't reachable via any IP address of its own at all; it works purely through the route table entry. The enableDnsHostnames option is wrong because that attribute affects DNS hostname assignment for instances, not whether a gateway endpoint's routing takes effect.
Source: AWS PrivateLink Guide: Gateway endpoints — 'When you create a gateway endpoint, you select the VPC route tables for the subnets that you enable... All instances in the subnets associated with a route table associated with a gateway endpoint automatically use the gateway endpoint.'