Interface VPC endpoints that never processed 1 MiB in an hour across 30 days

Every Availability Zone is a separate hourly charge

AWS PrivateLink pricing bills an interface endpoint for each hour it remains provisioned in each Availability Zone, irrespective of the state of its association with the service, and hourly billing stops only when you delete it. Data processing is added on top, starting at $0.01 per GB.

An endpoint deployed across three subnets for resilience is three hourly charges. Teams often add endpoints for services like ECR, STS or SSM when building a private VPC and keep them after the workloads move. Gateway endpoints for S3 and DynamoDB are a different product with no additional charge, so they are not part of this check.

Pulling endpoint traffic from CloudWatch

The AWS/PrivateLinkEndpoints namespace carries BytesProcessed, which the PrivateLink metrics page describes as bytes exchanged in both directions and billed to the endpoint owner:

aws ec2 describe-vpc-endpoints \
  --filters Name=vpc-endpoint-type,Values=Interface \
  --query 'VpcEndpoints[].[VpcEndpointId,VpcId,ServiceName,State]' --output table

Then open CloudWatch, choose the AWS/PrivateLinkEndpoints namespace and graph BytesProcessed for the endpoint’s VPC Endpoint Id dimension set over 30 days with the Sum statistic.

The three facts ZopNight needs

1. The endpoint type is Interface and its state is available.
2. BytesProcessed has 30 days of coverage and its highest hourly reading stays under 1 MiB, so a single busy hour rules the endpoint out.
3. ZopNight can count the endpoint’s network interfaces, or failing that its subnets, and has an hourly per-interface rate for the Region.

Endpoints ZopNight will not price

Gateway and Gateway Load Balancer endpoints are skipped, as is any endpoint whose type is unknown. Less than 30 days of metric history, a missing metric, a missing interface and subnet count, or no rate means no finding; ZopNight will not show a card with a $0 figure. ZopNight ships this finding switched off by default, so it may not appear in your account.

Calculating the per-interface fee

saving = hourly rate per endpoint interface x number of interfaces (or subnets) x hours per month
cost after fix = 0

Data processing is left out because an idle endpoint processes almost nothing.

Removing the endpoint

1. Confirm the 30-day BytesProcessed total in CloudWatch.
2. Check which workloads in the VPC resolve the service’s private DNS name to this endpoint.
3. Delete it with aws ec2 delete-vpc-endpoints --vpc-endpoint-ids vpce-0123456789abcdef0.
4. Tidy the security groups that existed only for the endpoint.