S3/DynamoDB Traffic to Gateway Endpoint

Opportunity Name:

AWS Resource Type:

AWS PrivateLink VPC Endpoints

Opportunity Description:

This opportunity creates S3/DynamoDB Gateway Endpoints in VPCs with NAT gateways, eliminating NAT gateway data transfer costs for S3 and DynamoDB traffic.

Criteria for identifying the opportunity:

By default, VPC-attached compute resources such as EC2 instances, ECS containers, and Lambda functions typically access S3 and DynamoDB service endpoints via the Internet.

This often requires a NAT gateway to provide a public IP address, which incurs data processing costs for each GB of traffic transferred. AWS offers S3 and DynamoDB Gateway endpoints for free, which route traffic directly from your VPC over a private connection, bypassing the NAT gateway.

This opportunity is applied to VPCs that match the following criteria:

VPC has attached NAT gateway(s)
VPC does not currently have S3 or DynamoDB gateway endpoints
The NAT gateway's annualized S3/DynamoDB data-processing cost exceeds your account's configured cost threshold. This is a dollar-cost threshold applied to the NAT gateway's Cost and Usage Report line items — not a fixed data-volume figure such as a flat GB amount.

This check is performed per NAT gateway, in the region where that NAT gateway and its VPC are located. It is not restricted to specific AWS regions such as us-east-1 or us-west-1 — it applies wherever a NAT gateway with eligible traffic exists.

Potential savings (range in % on annual basis):

Cost savings are dependent on your specific S3 and DynamoDB usage patterns. You can expect to save $0.045 for each GB transferred to/from S3/DynamoDB in the US East 1 region (see pricing for NAT gateway data processing charges in other regions).

What happens when the Fixer is executed?

An S3 and/or DynamoDB gateway endpoint is created (if one doesn't already exist) and automatically attached to every identified NAT-routing route table in the target VPC — this applies whether the route table serves a public or a private subnet. Once complete, all S3/DynamoDB traffic from those route tables is automatically routed via the gateway endpoints instead of the NAT gateway.

Exception: if an existing gateway endpoint already has a custom (non-default) endpoint policy attached, CloudFix withholds the automatic recommendation rather than widening that policy's reach to additional route tables. The finding is still reported for manual review, but the route tables are not attached automatically in that case.

Is it possible to rollback once CloudFix implements the fixer?

Yes - you can manually delete S3/DynamoDB gateway endpoints. Once deleted, S3/DynamoDB traffic will be routed via the Internet.

Can CloudFix implement the fix automatically once I accept the recommendation?

Yes

Does this fix require downtime?

No, however existing connections to S3/DynamoDB may be disconnected, interrupting any in-progress data transfers.

All AWS SDKs include retry behavior, which ensures S3/DynamoDB clients can automatically recover from any disconnections.