Internet Gateway vs VPC endpoints
In chapter 1 the society got one main gate, and one route line, 0.0.0.0/0, sent everything else through it. That gate is not the only way out. A server that needs something outside the VPC has two doors to choose from.
1. Two doors
One door opens onto the public road. The other is a private passage to a single AWS service.
2. Internet Gateway
An Internet Gateway connects the VPC to the public internet. Traffic can go out to many places, and the internet can come in when you allow it.
A public server uses this door when:
- A customer opens your public website.
- The server connects to GitHub or calls a public API.
- The server calls an AWS service through that service’s public address.
For a public EC2 instance, three things have to line up. Miss one and the gate does nothing.
A public address
A public IPv4 address or an Elastic IP, so the internet has a number to answer.
A route
0.0.0.0/0 → learn-igw. That line is the road out, and the road in.
Permission
The security group and the network ACL both allow the traffic you expect.
3. What is learn-igw?
learn-igw is the name on the Internet Gateway from chapter 1. It is not a special kind of gateway. We typed that name when we created the gate and attached it to learn-vpc.
| What you see | What it is |
|---|---|
learn-igw | The name tag we chose in the console |
| The id | AWS calls that same gate igw-03d8b88d0eca47fcd. The CLI uses this id. |
| Attached | It belongs to learn-vpc. While it is detached, it does nothing. |
| The route | 0.0.0.0/0 → learn-igw is the road. Without that line, the gate has no path to it. |
The gate is free. You pay for the traffic and for public addresses, not for learn-igw itself.
4. Does the road have to say 0.0.0.0/0?
No. Chapter 1 showed that a route's destination is just a range of addresses. 0.0.0.0/0 is the widest range, but you can name any range you like. Suppose a server only ever needs S3. Could you open the gate for S3's addresses alone?
| Destination | Target | Effect |
|---|---|---|
52.95.169.0/24 (an S3 range) | learn-igw | Only traffic to that range goes out the gate |
That works, with two catches.
Everything else stops
Only the listed range has a road out. curl google.com now fails, because no line matches Google's address.
S3 addresses move
S3 uses many ranges, and AWS changes them often. A range typed by hand soon misses some of them. AWS publishes the current list in ip-ranges.json.
AWS gives you two better ways to send a server only to S3.
- The S3 prefix list as the destination. In the route's destination box, pick
pl-xxxx (com.amazonaws.eu-north-1.s3)instead of typing a range. A prefix list is a named set of ranges that AWS keeps up to date, so it always covers every S3 address in the region. The traffic still leaves through the gate and crosses the public internet. - An S3 gateway endpoint. Usually the best choice. AWS adds that same prefix-list route for you, but points it at a private passage instead of the gate. Traffic reaches S3 over AWS's own network, the server needs no public IP, and it costs nothing. The rest of this chapter is about that passage.
In short: 0.0.0.0/0 sends everything out to the internet, a specific range sends only that range, and an S3 endpoint is the right way to reach only S3.
5. VPC endpoint
A VPC endpoint is a private connection from your VPC to one supported AWS service. The packets stay on the AWS network. They do not use an Internet Gateway or a NAT Gateway.
Gateway endpoint
A route in the route table. Used for S3 and DynamoDB. No extra network card, and no hourly charge. The route is the prefix-list line from the last section, with the endpoint as its target.
Interface endpoint
A private network interface inside a subnet. Used for services such as Secrets Manager and Systems Manager. Chapter 3 uses a close relative, the EC2 Instance Connect Endpoint, to open SSH to a private server.
6. The same download, two paths
The server needs a file from S3. Both doors can do that job. Only one of them needs the public internet.
7. Society, gate, tunnel
Main gate
Society, then the main gate, then the public road, then any public destination. One exit, many places.
Private tunnel
Society, then a private tunnel, then the S3 building. That tunnel cannot take you anywhere else.
8. Key differences
| Question | Internet Gateway | VPC endpoint |
|---|---|---|
| Connects to | The public internet | One supported AWS service |
| Websites | Yes. Google, GitHub, public APIs | No |
| Visitors in | Yes, when the route and the locks allow it | No. It is not a way in from the internet |
| Public routing | Yes. Traffic uses the public internet | No. Traffic stays on the AWS network |
| One service only | No | Yes |
| Usual job | Public sites and general internet access | Private access to S3, DynamoDB, Secrets Manager, and similar services |
9. S3 yes, GitHub no
A private server needs a file from S3 and code from GitHub. The S3 endpoint can do only the first.
To reach GitHub, the server still needs the public road.
Private server
EC2, then a NAT Gateway, then the Internet Gateway, then GitHub. The server stays private. The NAT Gateway is what walks out the gate.
Public server
EC2, then the Internet Gateway, then GitHub. The server itself has a public address and the 0.0.0.0/0 route.
Remember only this
- Internet Gateway opens a route to the public internet.
- VPC endpoint opens a private route to one supported AWS service.
- A route can name any range, but for S3 use the prefix list, or better, a gateway endpoint.
- An S3 endpoint can fetch from S3. It cannot fetch from GitHub.
Next: build it. Chapter 3 puts a server on a private street with no road to the gate, reaches S3 through a gateway endpoint, and locks the bucket so only that endpoint gets in.