AWS cost · interface VPC endpoints

Interface VPC endpoints bill per AZ, even with no traffic

Every guide to cutting AWS network costs tells you to add VPC endpoints, and for S3 and DynamoDB there is a free endpoint that makes that advice true. Every other service, and S3 if you pick the wrong type, gets an interface endpoint instead. An interface endpoint puts a network interface in each subnet you select, and AWS bills each one by the hour whether or not a single byte moves. It is not a server, it does not appear in any instance list, and nothing ever flags it - so it sits there, one line on the bill, priced by a number nobody chose.

An interface VPC endpoint costs $0.01/hour per Availability Zone in us-east-1 - about $7.30/month per AZ, or $21.90/month for a normal three-AZ deployment - plus $0.01/GB processed. Gateway endpoints are free, but only S3 and DynamoDB have one, and S3 will happily sell you the paid kind instead. The charge is per subnet, so the multiplier is the part that hurts.

How much does an interface VPC endpoint really cost?

A cent an hour reads like nothing. Multiply it by the AZs, then by the number of services you added an endpoint for:

The four-endpoint line is a real account, posted to r/aws by someone cleaning up an environment where every instance was stopped and the database was paused. It was still spending about $500/month, and idle interface endpoints were the single largest item on it.

Why is the charge per AZ and not per endpoint?

Because you are not really buying an endpoint. You are buying an elastic network interface in each subnet you attached it to, and each one is billed separately. The console asks which subnets to use and every sensible answer is all of them, so the default deployment is three or four times the price the documentation quotes. Nobody consciously picks that multiplier - it arrives with the high availability you already wanted.

Outside us-east-1 the rate is higher: $8.76/month per AZ in eu-central-1 and $8.03/month per AZ in eu-west-1. Four endpoints across three AZs in Frankfurt is $105/month before any traffic.

Is your S3 endpoint the free one?

S3 is the one service where both types exist for the same traffic, and the type is chosen when the endpoint is created. A Gateway endpoint for S3 costs nothing. An interface endpoint for S3 costs the full $7.30/month per AZ. Same service name, same bucket, two very different lines on the bill.

The paid one is not a mistake by design. It gives S3 private IP addresses inside your VPC, which is what makes the bucket reachable from on-premises over Direct Connect or VPN, and across Regions. That reach is the whole product. If your traffic starts inside the VPC, you are paying for a capability you are not using, and the Gateway endpoint does the same job for free.

When is an endpoint cheaper than the NAT gateway?

This is the calculation the usual advice skips. An interface endpoint costs $7.30/month per AZ plus $0.01/GB. Sending the same traffic through a NAT gateway costs $0.045/GB in processing. So the endpoint saves $0.035 on every gigabyte, and it has to save $7.30 per AZ before it breaks even - which takes about 208 GB/month, per AZ.

Above that volume the endpoint wins and keeps winning. Below it, you are paying a fixed fee to avoid a variable one you were barely incurring. This only compares the processing charge, because the NAT gateway keeps billing its own ~$33/month base rate unless the endpoints let you delete it entirely - which is where the real saving is, and why the answer changes once the last route to the internet is gone.

How do I find interface endpoints nobody is using?

List the interface endpoints with their subnet count, which is what you are actually paying for, then check whether anything talks to them. The traffic metric needs all five of its dimensions - a partial set matches no data at all and reads back as an idle endpoint, which is the one mistake that turns this check into a false positive:

# interface endpoints and the number of subnets each one bills for
aws ec2 describe-vpc-endpoints \
  --query "VpcEndpoints[?VpcEndpointType=='Interface'].{Id:VpcEndpointId,Service:ServiceName,AZs:length(SubnetIds),State:State}" \
  --output table

# bytes through one endpoint in one subnet (near zero = nothing uses it)
aws cloudwatch get-metric-statistics \
  --namespace AWS/PrivateLinkEndpoints --metric-name BytesProcessed \
  --dimensions Name=VpcId,Value=vpc-0123456789abcdef0 \
               Name=VpcEndpointId,Value=vpce-0123456789abcdef0 \
               Name=EndpointType,Value=Interface \
               Name=SubnetId,Value=subnet-0123456789abcdef0 \
               Name=ServiceName,Value=com.amazonaws.us-east-1.ssm \
  --start-time 2026-07-29T00:00:00Z \
  --end-time   2026-08-12T00:00:00Z \
  --period 86400 --statistics Sum

# deletes it - run only once you have confirmed nothing needs the private DNS
aws ec2 delete-vpc-endpoints --vpc-endpoint-ids vpce-0123456789abcdef0

Before deleting, check whether the endpoint has private DNS enabled. If it does, the service hostname currently resolves to a private address inside the VPC, and removing the endpoint sends those calls back out through the public path. In a private subnet with no NAT route, they stop working rather than get more expensive.

Frequently asked questions

More AWS cost breakdowns