3 ms·

The problem is that VPC endpoints aren't free. They should be, of course, at least when the destination is an AWS service in the same region. [edit: I'm speak

The problem is that VPC endpoints aren't free. They should be, of course, at least when the destination is an AWS service in the same region. [edit: I'm speaking about interface endpoints, but S3 and DynamoDB can use gateway endpoints, which are free to the same region]

paulddraper 1y ago
Well yeah that's the point....why route through the public internet.
- kbolino 1y ago
  I doubt the traffic ever actually leaves AWS. Assuming it does make it all the way out to their edge routers, the destination ASN will still be one of their own. Not that the pricing will reflect this, of course. The other problem with (interface) VPC endpoints is that they eat up IP addresses. Every service/region permutation needs a separate IP address drawn from your subnets. Immaterial if you're using IPv6, but can be quite limiting if you're using IPv4.
  - immibis 1y ago
    Sounds like a good reason to use IPv6.
    - kbolino 1y ago
      There were still a couple of services/features that choked on IPv6 last time I looked (1.5-2 years ago) but it works with most things and they do seem to be making progress on the others.
      - paulddraper 1y ago
        I don’t know any software that doesn’t work with IPv6 as of 2021. Just some internet services that haven’t upgraded. (But fixed by NAT.)
        kbolino 1y ago
        There's a matrix provided by Amazon themselves listing the level of IPv6 support in their various services: https://docs.aws.amazon.com/vpc/latest/userguide/aws-ipv6-support.html https://docs.aws.amazon.com/vpc/latest/userguide/aws-ipv6-su...
otterley 1y ago
Gateway endpoints are free. Network endpoints (which are basically AWS-managed ENIs that can tunnel through VPC boundaries) are not free. S3 can use either, and we recommend establishing VPC Gateway endpoints by default whenever you need S3 access. (Disclaimer: I work for AWS, opinions are my own.)
- kbolino 1y ago
  Fair point, and valid for S3 (the topic at hand) and DynamoDB. Other AWS services, though, don't support gateway endpoints.
  - mdaniel 1y ago
    https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html#ecr-setting-up-vpc-create https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-e... ~~I get the impression there are several others, too, but that one is of especial interest to me~~ Wowzers, they really are much better now: aws --region us-east-1 ec2 describe-vpc-endpoint-services | jq '.ServiceNames|length' 459 If you're saying "other services should offer VPC Endpoints," I am 100% on-board. One should never have to traverse the Internet to contact any AWS control plane
    - watermelon0 1y ago
      Those are VPC endpoints, not gateway endpoints.
      - kbolino 1y ago
        Both interface endpoints and gateway endpoints are also called VPC endpoints. The former get distinct IP addresses in your VPC subnets while the latter get distinct entries in your VPC routing tables. They are even created with the same API call: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpcEndpoint.html https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_C...
- JoshTriplett 1y ago

paulddraper 1y ago

Well yeah that's the point....why route through the public internet.

kbolino 1y ago
I doubt the traffic ever actually leaves AWS. Assuming it does make it all the way out to their edge routers, the destination ASN will still be one of their own. Not that the pricing will reflect this, of course. The other problem with (interface) VPC endpoints is that they eat up IP addresses. Every service/region permutation needs a separate IP address drawn from your subnets. Immaterial if you're using IPv6, but can be quite limiting if you're using IPv4.
- immibis 1y ago
  Sounds like a good reason to use IPv6.
  - kbolino 1y ago
    There were still a couple of services/features that choked on IPv6 last time I looked (1.5-2 years ago) but it works with most things and they do seem to be making progress on the others.
    - paulddraper 1y ago
      I don’t know any software that doesn’t work with IPv6 as of 2021. Just some internet services that haven’t upgraded. (But fixed by NAT.)
      - kbolino 1y ago
        There's a matrix provided by Amazon themselves listing the level of IPv6 support in their various services: https://docs.aws.amazon.com/vpc/latest/userguide/aws-ipv6-support.html https://docs.aws.amazon.com/vpc/latest/userguide/aws-ipv6-su...

otterley 1y ago

Gateway endpoints are free. Network endpoints (which are basically AWS-managed ENIs that can tunnel through VPC boundaries) are not free. S3 can use either, and we recommend establishing VPC Gateway endpoints by default whenever you need S3 access. (Disclaimer: I work for AWS, opinions are my own.)

kbolino 1y ago
Fair point, and valid for S3 (the topic at hand) and DynamoDB. Other AWS services, though, don't support gateway endpoints.
- mdaniel 1y ago
  https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html#ecr-setting-up-vpc-create https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-e... ~~I get the impression there are several others, too, but that one is of especial interest to me~~ Wowzers, they really are much better now: aws --region us-east-1 ec2 describe-vpc-endpoint-services | jq '.ServiceNames|length' 459 If you're saying "other services should offer VPC Endpoints," I am 100% on-board. One should never have to traverse the Internet to contact any AWS control plane
  - watermelon0 1y ago
    Those are VPC endpoints, not gateway endpoints.
    - kbolino 1y ago
      Both interface endpoints and gateway endpoints are also called VPC endpoints. The former get distinct IP addresses in your VPC subnets while the latter get distinct entries in your VPC routing tables. They are even created with the same API call: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpcEndpoint.html https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_C...
JoshTriplett 1y ago