VPC endpoints let you access cloud services without the public internet. Traffic stays within the provider's network.
Gateway endpoints:
- Support S and DynamoDB only
- Free to use
- Add route table entries
Interface endpoints:
- Support most other services
- Create network interfaces in subnets
- Hourly cost plus data fees
Benefits:
- Traffic never leaves cloud network
- Reduced data transfer costs
- Better security
- No NAT or internet gateway needed
Endpoint policies: Control which resources can be accessed through the endpoint.