Ravindra BagaleCourses & study guides मराठी Track your progress

How to Access S3 from a Private EC2 Instance with a VPC Gateway Endpoint (No NAT)

By , trainer LinkedIn Last updated:

In What Is Amazon S3? we used S3 from the console and CloudShell. Real app servers sit in private subnets with no public IP. This chapter shows where S3 lives compared to your VPC, how a private server reaches it through a NAT gateway and why that costs money, and the better way: a free S3 gateway endpoint. We also compare it with the paid interface endpoint, write an endpoint policy, and build the whole thing in a lab with no NAT.

What you'll learn in this chapter

  • Why S3 is outside your VPC and what that means
  • Private EC2 to S3 through NAT, with the cost math
  • Gateway endpoint (free) vs interface endpoint (paid)
  • Endpoint policies that limit which buckets are reachable
  • A full lab: private EC2 reaches S3 with no NAT

1. A courier story

Your office is inside a gated society with no main-road gate (a private subnet). The bank (S3) is outside, in the city.

Way 1: send every paper through a paid courier at the society gate (NAT gateway). It works, but every trip and every kilo costs money.

Way 2: the bank opens a free private lane straight into your society (gateway endpoint). Papers never touch the public road, and nobody charges per kilo.

2. Where S3 lives compared to your VPC

Why do we need this?

If you think S3 is inside your VPC, you will not understand why a private server cannot reach it.

What is it?

S3 is a regional public service. Its endpoint, like s3.ap-south-1.amazonaws.com, resolves to public IP addresses owned by AWS. Your VPC is your private network. To reach a public service, a server needs a path out: an internet gateway with a public IP, a NAT gateway, or a VPC endpoint.

ServerPath to S3Cost
Public subnet, public IPInternet gatewayFree path; data in the same Region is free
Private subnet, NATNAT gateway → internet gatewayNAT hourly + per-GB processing
Private subnet, gateway endpointRoute table entry to S3 prefix listFree
Private subnet, interface endpointENI with a private IP (PrivateLink)Hourly per AZ + per GB

3. Private EC2 to S3 through a NAT gateway

Why do we need this?

Most VPCs already have a NAT gateway for updates, so S3 traffic often goes there by default. You must know what it costs.

What is it?

A NAT gateway lets private servers go out to the internet. Each GB that passes through it is charged. In us-east-1 it is about $0.045 per hour plus $0.045 per GB processed.

S3 through NATPrivate EC210.20.1.15Route 0.0.0.0/0→ NAT gatewayNAT gateway$ per GBInternet gatewayAmazon S3public endpoint
Every byte to S3 passes the NAT and is billed there.

Worked cost: nightly backups upload 2 TB a month to S3. Through NAT: 2,048 GB × $0.045 = about $92 a month, on top of the NAT hourly fee. Through a gateway endpoint: $0.

4. VPC endpoints: gateway vs interface

Why do we need this?

An endpoint gives private servers a private path to AWS services without NAT or a public IP. S3 offers two kinds, and picking the right one matters for cost.

What is it?

PointGateway endpointInterface endpoint
ServicesOnly S3 and DynamoDBS3 and 100+ other services
How it worksAdds a route to the S3 prefix list (pl-…) in chosen route tablesCreates an ENI with a private IP in each chosen subnet (PrivateLink)
PriceFree~$0.01/hour per AZ + ~$0.01/GB
Reach from on-premises or peered VPCNoYes (over VPN, Direct Connect, peering)
Same Region onlyYesYes (cross-Region needs extra setup)
Security groupNot usedYes, on the ENI

Ravindra Bagale's Tip

For EC2 inside the VPC, start with the free gateway endpoint. Choose an interface endpoint only when traffic comes from on-premises or another network that cannot use your route tables.

S3 through a gateway endpointPrivate EC210.20.1.15Route pl-78a54011→ vpce-0abcGateway endpointfreeAmazon S3same Region
No NAT, no internet: the route table sends S3 traffic to the endpoint.

5. Endpoint policies

Why do we need this?

A gateway endpoint by default allows access to every S3 bucket in the Region, even other people's buckets. A stolen server could copy your data to an attacker's bucket.

What is it?

An endpoint policy is a JSON resource policy on the endpoint. It is a gate: requests through the endpoint must be allowed by the endpoint policy AND by IAM and the bucket policy.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "OnlyOurBuckets",
    "Effect": "Allow",
    "Principal": "*",
    "Action": ["s3:GetObject","s3:PutObject","s3:ListBucket"],
    "Resource": [
      "arn:aws:s3:::reels-app-media",
      "arn:aws:s3:::reels-app-media/*"
    ]
  }]
}

Why each part: Principal "*" because the endpoint does not know users; IAM still checks them. Resource lists only our bucket, so any other bucket is denied. Add the Amazon Linux repo bucket arn:aws:s3:::al2023-repos-ap-south-1-de612dc2/* if servers run dnf through the endpoint.

The other side: a bucket policy can require that requests come through your endpoint with the condition aws:SourceVpce. The security chapter shows that example.

6. Using S3 from a private server in many stacks

Why do we need this?

With a gateway endpoint, apps need no code change. They keep calling the normal regional S3 endpoint; the route table does the rest. Only the Region must be correct.

What is it?

StackSet the Region so traffic stays in ap-south-1
AWS CLIaws configure set region ap-south-1
Node.jsnew S3Client({ region: "ap-south-1" })
Python boto3boto3.client("s3", region_name="ap-south-1")
JavaS3Client.builder().region(Region.AP_SOUTH_1).build()
PHPnew S3Client(['region'=>'ap-south-1','version'=>'latest'])
.NETnew AmazonS3Client(RegionEndpoint.APSouth1)
Goconfig.LoadDefaultConfig(ctx, config.WithRegion("ap-south-1"))
nginx / ApacheCron job: aws s3 sync s3://site-assets /var/www/html/assets
MySQLmysqldump shop | gzip | aws s3 cp - s3://db-backups/shop-$(date +%F).sql.gz

Ravindra Bagale's Tip

If the Region is wrong (for example us-east-1), the request tries the internet path and hangs on a private server. A gateway endpoint only works for buckets in the same Region as the VPC.

7. Lab: private EC2 reaches S3 through a gateway endpoint with no NAT

Why do we need this?

You will prove three things: without a path the private server cannot reach S3; after adding the gateway endpoint it can; and the endpoint policy can block other buckets.

How to do it (step by step)

Part A: network

  1. Region ap-south-1. VPC console › Create VPC › VPC and more. Why: the wizard makes subnets and route tables for us.
  2. Name tag auto-generation: s3lab. IPv4 CIDR: 10.20.0.0/16.
  3. Number of AZs: 1. Public subnets: 1. Private subnets: 1. Why: the smallest setup that shows the idea.
  4. NAT gateways: None. VPC endpoints: None. Why: we want no path first, then add the endpoint by hand.
  5. Click Create VPC. Expected: VPC, 2 subnets, 2 route tables, 1 internet gateway.

Part B: bucket and IAM role

  1. Create bucket yourname-s3lab-private in ap-south-1 (defaults). Upload hello.txt with text from S3.
  2. IAM › Roles › Create role › Trusted entity AWS service › Use case EC2.
  3. Permissions: AmazonS3ReadOnlyAccess. Name: s3lab-ec2-role. Why: the server gets temporary credentials, no keys on disk.

Part C: two servers

  1. Launch s3lab-bastion: Amazon Linux 2023, t3.micro, VPC s3lab, public subnet, auto-assign public IP Enable, SG allows SSH 22 from My IP.
  2. Launch s3lab-private: same AMI, private subnet, public IP Disable, SG allows SSH 22 from the bastion SG, IAM instance profile s3lab-ec2-role.
  3. From your laptop: ssh-add key.pem then ssh -J ec2-user@BASTION_IP ec2-user@10.20.x.x. Why: the key stays on the laptop.

Part D: test with no path

aws configure set region ap-south-1
aws s3 ls s3://yourname-s3lab-private --cli-connect-timeout 5
# Connect timeout on endpoint URL: "https://yourname-s3lab-private.s3.ap-south-1.amazonaws.com/..."

Why it fails: the private route table has only 10.20.0.0/16 → local. There is no route to S3.

Part E: add the gateway endpoint

  1. VPC › Endpoints › Create endpoint. Name s3lab-s3-gw. Type AWS services.
  2. Search s3, pick com.amazonaws.ap-south-1.s3 with Type Gateway. Why: the Interface one costs money.
  3. VPC s3lab-vpc. Route tables: tick only the private route table. Why: only that subnet needs the private path.
  4. Policy: Full access for now. Click Create endpoint. Expected: status Available.
  5. Open the private route table › Routes. Expected: a new route pl-78a54011 (com.amazonaws.ap-south-1.s3) → vpce-…. The prefix list ID may differ in your account; check it under Managed prefix lists.
aws s3 ls s3://yourname-s3lab-private
# 2026-10-22 11:20:44   8 hello.txt
aws s3 cp s3://yourname-s3lab-private/hello.txt - 
# from S3
curl -s --max-time 5 https://www.google.com || echo "no internet (good)"
# no internet (good)

Verification: S3 works, the general internet does not. The server is still private.

Part F: limit it with an endpoint policy

  1. Endpoints › s3lab-s3-gw › Policy › Edit policy › Custom. Paste the policy from the endpoint policy section, with your bucket name. Save.
  2. On the private server, list your bucket: it works. List any other bucket you own: An error occurred (AccessDenied). Why: the endpoint now allows only one bucket.

Cleanup

  1. Terminate both instances.
  2. Delete the endpoint s3lab-s3-gw.
  3. Empty and delete the bucket: aws s3 rb s3://yourname-s3lab-private --force (from CloudShell).
  4. Delete the VPC s3lab-vpc (this removes its subnets, route tables and internet gateway). Delete the role s3lab-ec2-role.

8. Interview questions

Q. Is S3 inside your VPC?

No. S3 is a regional public service. A VPC reaches it through an internet gateway, a NAT gateway or a VPC endpoint.

Q. Gateway endpoint vs interface endpoint for S3?

Gateway: free, route table entry, only from inside the VPC. Interface: an ENI with a private IP, paid per hour and GB, reachable from on-premises and peered networks.

Q. Why move S3 traffic off the NAT gateway?

NAT charges per GB processed. A gateway endpoint carries the same traffic for free.

Q. What does an endpoint policy do?

It limits which actions and buckets can be used through the endpoint, on top of IAM and bucket policies.

Q. A private server with a gateway endpoint still times out on S3. Why?

Usually a wrong Region (bucket in another Region), or the endpoint is not associated with that subnet's route table.

Try at home

  1. Repeat the lab, then add a second private route table and see that its subnet cannot reach S3 until you tick it in the endpoint.
  2. Work out the monthly NAT cost of uploading 500 GB of logs, and compare it with a gateway endpoint.
  3. Write an endpoint policy that allows only s3:GetObject on one prefix.

In short

  1. S3 is outside the VPC; private servers need a path.
  2. NAT works but charges per GB.
  3. Gateway endpoint: free route to S3 in the same Region.
  4. Interface endpoint: paid ENI, for on-premises and peered networks.
  5. Endpoint policy limits which buckets are reachable.

Practice Tasks

About this scenario

Latur Coaching Classes is a coaching business in Latur. Pooja Jadhav looks after its IT and cloud work. They count money in INR and run their AWS resources in the ap-south-1 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.

0 / 12

Easy How many addresses in a /16?

Why: Picking a VPC size needs this count.

What to do: Latur Coaching Classes plans the VPC 10.56.0.0/16. How many IP addresses does it hold in total?

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Easy Create a VPC

Why: A VPC is your own private network in AWS. Everything else lives inside it.

What to do: Create a VPC with the CIDR block 10.2.0.0/16.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Easy Create an internet gateway

Why: Without an internet gateway, nothing in the VPC can reach the internet.

What to do: Create a new internet gateway.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Create a subnet in one AZ

Why: Subnets split the VPC range and each one lives in exactly one AZ.

What to do: In vpc-0ccc135aa5deadbee, create subnet 10.2.1.0/24 in ap-south-1a.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Add the internet route

Why: A subnet is "public" only when its route table sends 0.0.0.0/0 to an internet gateway.

What to do: In route table rtb-023aaa135bb5bb22, send all internet traffic (0.0.0.0/0) to igw-03aaa135bb5aa11.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Find the VPC router address

Why: AWS reserves base+1 for the router.

What to do: Which address does AWS reserve for the VPC router in subnet 10.56.4.0/24?

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Medium Usable IPs in an AWS /24 subnet

Why: AWS keeps 5 addresses in every subnet.

What to do: How many addresses can Latur Coaching Classes use for servers in subnet 10.56.1.0/24 on AWS?

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Medium Link a subnet to a route table

Why: Until you associate it, a subnet uses the main route table.

What to do: Associate subnet subnet-023aaa135bb5bb1 with route table rtb-023aaa135bb5bb22.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Attach the internet gateway

Why: A gateway does nothing until it is attached to a VPC.

What to do: Attach igw-03aaa135bb5aa11 to vpc-0ccc135aa5deadbee.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium First usable IP for a server

Why: The first 4 addresses are reserved by AWS.

What to do: What is the first IP address a server can get in 10.56.20.0/24 on AWS?

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Hard Pick the smallest prefix

Why: Right-sizing saves address space.

What to do: A subnet must hold 100 servers on AWS. What is the largest prefix number (smallest subnet) that fits? Answer like /25.

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Hard Split a /24 into two

Why: Public and private subnets often split one block.

What to do: Split 10.56.8.0/24 into two equal subnets. Write both CIDRs separated by a comma.

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

See all practice tasks in the Task Hub →

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

Revision card: S3 gateway endpoint. S3 lives outside your VPC. A private EC2 needs a path. NAT works but charges per GB. A gateway endpoint is free. It adds a prefix-list route in the route tables you pick. Same Region only. S3 and DynamoDB only.
Revision card: S3 gateway endpoint · Download PNG
Revision card: S3 endpoint policy. The endpoint can carry a policy, like a filter on the pipe. Allow only your buckets so data cannot go to someone else's bucket. Remember the OS repo bucket if dnf uses S3. Other bucket through it: AccessDenied.
Revision card: S3 endpoint policy · Download PNG
Comparison: NAT gateway vs S3 gateway endpoint. NAT gateway: Managed outbound internet for private subnets, billed per hour and per GB. S3 gateway endpoint: A route to S3 inside AWS for the VPC, no charge.
Comparison: NAT gateway vs S3 gateway endpoint · Download PNG
Comparison: Gateway endpoint vs Interface endpoint. Gateway endpoint: A route table entry for S3 or DynamoDB in the same Region. Interface endpoint: An ENI with private IPs in your subnets (PrivateLink).
Comparison: Gateway endpoint vs Interface endpoint · Download PNG
Interview card: Private EC2 sends lots of data to S3. NAT or endpoint?. Gateway endpoint: free and private, same Region. NAT costs per hour and per GB. 2 TB is about $92 in processing alone. Interface endpoint only when on-premises must reach S3 privately.
Interview card: Private EC2 sends lots of data to S3. NAT or endpoint? · Download PNG

More cards: Ravi Sir's Cards.