AWS Cloud Architecture•Part 2: Networking, VPC & Traffic Routing (6 - 20)
VPC Endpoints: Gateway vs Interface Endpoints.
In Simple Words:
- Gateway Endpoints: Targets added to route tables for Amazon S3 and DynamoDB. Free of charge; traffic never leaves AWS's private network.
- Interface Endpoints (PrivateLink): Provisions Elastic Network Interfaces (ENIs) with private IP addresses inside your subnet for other AWS services (SQS, SNS, Secrets Manager). Billed hourly + per GB.
hcl
# Interface VPC Endpoint for AWS Secrets Manager:
resource "aws_vpc_endpoint" "secrets_manager" {
vpc_id = aws_vpc.main.id
service_name = "com.amazonaws.us-east-1.secretsmanager"
vpc_endpoint_type = "Interface"
subnet_ids = aws_subnet.private[*].id
security_group_ids = [aws_security_group.endpoint_sg.id]
private_dns_enabled = true
}