Core concept
Interface Endpoint: DNS resolves to ENI in your VPC. Powered by NLB in provider VPC. Cross-account exposure.
Advertisement
How it works
Gateway Endpoint: only for S3 + DynamoDB. Route in route table. Free.
Advertisement
Trade-offs + gotchas
Access AWS services from private subnet without NAT. SaaS access. Multi-account service sharing. Compliance (no internet).