# Missing VPC Endpoints for High-Volume AWS Service Access

Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/missing-vpc-endpoints-for-high-volume-aws-service-access

[Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) 

# Missing VPC Endpoints for High-Volume AWS Service Access

## Explanation

When EC2 instances, Lambda functions, or containerized workloads access AWS-managed services without VPC Endpoints, that traffic exits the VPC through a NAT Gateway or Internet Gateway. This introduces unnecessary egress charges and NAT processing costs, especially for data-intensive or high-frequency workloads.

## Relevant Billing Model

## Detection

- Review VPC architecture for services that communicate with S3, DynamoDB, Secrets Manager, or other AWS-managed APIs

- Check whether Gateway Endpoints for S3 and DynamoDB exist and are attached to relevant route tables

- Identify missing Interface Endpoints for high-traffic services like Secrets Manager, SSM, or KMS

- Analyze NAT Gateway metrics (bytes processed per destination service) to quantify potential endpoint-eligible traffic

- Correlate NAT Gateway charges with known service access patterns to surface reroutable costs

## Remediation

- Provision Gateway Endpoints for S3 and DynamoDB in each VPC that accesses those services

- Create Interface Endpoints (via AWS PrivateLink) for services with frequent or latency-sensitive access (e.g., Secrets Manager, CloudWatch Logs)

- Ensure routing tables and DNS settings support private resolution to AWS services

- Embed VPC endpoint provisioning into infrastructure-as-code templates to ensure consistency across accounts and regions

- Monitor NAT Gateway data transfer volume over time to verify cost reduction after endpoint rollout

## Relevant Documentation

- [AWS Gateway Endpoints Overview](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html#gateway-endpoints\%22)

- [Interface Endpoints and AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html#interface-endpoints\)

- [AWS NAT Gateway Pricing](https://aws.amazon.com/vpc/pricing//)

- [AWS PrivateLink Pricing](https://aws.amazon.com/privatelink/pricing//)

[Submit Feedback](https://hub.pointfive.co/inefficiencies/missing-vpc-endpoints-for-high-volume-aws-service-access)

## At a glance

Reference

CER-0118

Cloud provider

AWS

Service

AWS VPC

Category

[Networking](https://www.pointfive.co/efficiency-hub/service-category/networking)

Inefficiency type

Inefficient Network Configuration

## Contributed by

- ### Trig Ghosh

---
Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.