Gateway VPC endpoint
Overview
Section titled “Overview”An S3 gateway VPC endpoint
S3 gateway VPC endpoint. Route-table target that keeps S3 traffic on the AWS network; no hourly charge for the gateway itself.
is a
route-table target, not an ENI. S3 traffic stays on the AWS network. The
gateway itself has no hourly charge.
Gateway vs interface
Section titled “Gateway vs interface”| Gateway | Interface (PrivateLink) | |
|---|---|---|
| Cost | No hourly / GB processing for the gateway | Hourly per AZ + data processing |
| Scope | Same-Region S3 only | Same-Region; cross-Region is a separate feature |
| Plumbing | Associate route tables | Subnets, security groups, private DNS |
This lab uses gateway endpoints plus
aws:SourceVpce
Bucket policy condition key aws:SourceVpce. Limits which VPC endpoint IDs can access the bucket. on the package bucket
policy so only allowlisted endpoints can read the repos. dnf / apt on the
consumer hosts then pull RPM and deb packages over that path without touching
the public internet.
Same-Region only
Section titled “Same-Region only”A Sydney gateway cannot reach the Auckland bucket. Auckland consumers need the replica package bucket and their own Auckland gateway endpoint. See Replication Sydney → Auckland and Lab findings: New Zealand.