What are VPC endpoints, and when would you use a gateway endpoint versus an interface endpoint?
What they are really testing: Whether you know how to keep traffic to AWS services off the public internet, the two endpoint types, and the cost/security reasons. A real architect-level distinction.
A real interview question
What are VPC endpoints, and when would you use a gateway endpoint versus an interface endpoint?
What most people say
drag me
“VPC endpoints let you connect to AWS services privately instead of over the internet.”
Correct at a high level but stops there. It does not distinguish gateway (S3/DynamoDB, free, route-based) from interface (PrivateLink, ENI, paid), which is exactly the architect-level decision being asked.
The follow-ups they ask next
Your private instances pull large amounts of data from S3 through a NAT gateway and the bill is high. What do you change?
Add an S3 gateway endpoint: it is free and routes S3 traffic over the AWS network, removing the NAT data-processing charges entirely for that traffic.
Why is a gateway endpoint free but an interface endpoint is not?
A gateway endpoint is just a route-table target (S3/DynamoDB only). An interface endpoint provisions an actual ENI via PrivateLink, which carries an hourly and per-GB cost.
What the interviewer is listening for
- Knows gateway = S3/DynamoDB, free, route-based
- Knows interface = PrivateLink ENI, paid, most services
- Cites security + NAT-cost savings
What sinks the answer
- Only "connect privately"
- Cannot distinguish the two types
- Unaware of the NAT cost angle
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“VPC endpoints [keep traffic to AWS services on the private network instead of via NAT/internet]. Gateway endpoints are [S3 and DynamoDB only, a route-table entry, free]. Interface endpoints are [PrivateLink ENIs for most services, billed hourly + per-GB]. Use them for [security and to cut NAT data-processing cost], with [endpoint policies to restrict access].”
Keep going with aws
Foundation
What are the EC2 purchasing options (On-Demand, Reserved, Savings Plans, Spot), and how do you mix them?
Foundation
Walk me through the main S3 storage classes and how you would use lifecycle policies to control cost.
Junior
How does AWS decide whether an IAM request is allowed? Explain the evaluation logic.
Junior
How does an EC2 Auto Scaling Group work, and how would you configure it to scale on load?
Mid
How do you choose between SQS, SNS, EventBridge, and Kinesis?
Mid
How does CloudFront work, and how would you use it to serve a web app efficiently and securely?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free