0

My team is currently burdened by the NAT Gateway costs and we would like to switch over to VPC Gateway endpoint to reduce the costs associated with all the EC2-S3 communication.

at the same time,

We would like to keep NAT gateway for any other communication apart from S3. My question is

How can we make sure that S3 communication from EC2 goes through VPC Endpoint gateway , but all other traffic uses NAT gateway

in other words

What happens in a scenario where S3 Endpoint is configured and also NAT Gateway is configured. Would the traffic flow from NAT/Internet Gateway or the S3 Endpoint?

How can we make it selective ?

Improve this question

1 Answer 1

Reset to default
0

Simply create an S3 Gateway VPC Endpoint, ensure an entry is in the route table (should be automatic if you do it in the console), and the S3 traffic will use the VPC Endpoint. Don't use the S3 interface endpoint, it costs money whereas S3 Gateway endpoint is free.

If a NAT Gateway and an S3 gateway endpoint are both available the S3 gateway will be used. A packet always uses the most specific route, the endpoint route is considered more specific than 0.0.0.0/0 which is the most general route.

If you were using an S3 Interface Endpoint for some reason I think it should be automatic. From memory, the VPC DNS returns an appropriate IP for S3 that goes over the interface endpoint rather than the NAT Gateway.

Improve this answer
2
  • hi @Tim thanks for the response, we are planning to go with gateway endpoint for S3 while still retaining a NAT gateway. From the answer I understand that when an instance is making a call to S3 and if it finds 2 routes in the route table , 1 for NAT and other for gateway endpoint, you mean to say endpoing gateway will take precedence and EC2 will always transact through endpoint gateway and never use NAT. Is my understanding correct ?
    – santhu
    Dec 12, 2022 at 14:51
  • Yes, the S3 gateway will be used. A packet always uses the most specific route, the endpoint route is considered more specific than 0.0.0.0/0.
    – Tim
    Dec 12, 2022 at 17:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .