Ravi Sir's Cards › AWS
Private or public path?
This comparison card contrasts Private or public path. VPC endpoint path (aws): sourceVpce fence. It also notes no public egress needed for S3. Public S3 endpoint via NAT is described as traffic exits NAT to public S3. It also notes sourceVpce Deny bites. The card pairs VPC endpoint path with sensitive private data planes, and Public S3 endpoint via NAT with admin laptops (usually denied by this policy).
Read card text
What this card says
Private or public path?
VPC endpoint path
aws:SourceVpce fence; no public egress needed for S3.
Public S3 endpoint via NAT
Traffic exits NAT to public S3; SourceVpce Deny bites.
Key points
Private-subnet ETL.
Ad-hoc laptop uploads.
Example
CreateVpcEndpoint + Deny-unless / NAT Gateway → s3.amazonaws.com
Use when
Sensitive private data planes.
Admin laptops (usually denied by this policy).