How would your EC2 in private VPC subnet talk to an AWS managed services like S3 or DynamoDB?

Imagine you have an application running inside an EC2 instance which is inside a private subnet. Then how can it communicate with a managed service like S3?

It is technically not possible because resources inside private subnet can not talk to resources outside of its VPC and managed services can not be enclosed inside VPCs because they are managed services.

One typical way is to use NAT resources inside a public subnet with Internet Gateway. But that is not entirely private communication right?

This is where VPC endpoints come into pictures. VPC endpoints lets you communicate with AWS managed services bypassing public internet routing.

Wait but how?

Two ways.

Gateway Endpoint

Interface Endpoint

Gateway Endpoint

As we have discussed that a resource inside a private VPC subnet can not communicate with any resources outside of the VPC.…