Amazon VPC Endpoint

A VPC endpoint gives private connectivity to AWS services without routing through a NAT gateway or an internet gateway. Two kinds exist, they bill nothing alike, and only one of them can waste money.

Gateway endpoints are free, interface endpoints are not

A Gateway endpoint, available for S3 and DynamoDB, is a route table entry. It costs nothing and it cannot be idle in any billable sense. An interface endpoint is PrivateLink: it provisions an elastic network interface in every subnet you attach it to, bills per interface-hour, and adds a charge per GB processed. The distinction is recorded during discovery as the endpoint type, and pricing only ever applies to interface endpoints. Confusing the two is how an endpoint cleanup exercise produces a list of resources that were never billing in the first place.

One interface per subnet is the real meter

Cost scales with availability zones, not with endpoints. An interface endpoint spanning three subnets bills three interfaces, so two endpoints are not comparable until you know how wide each one spreads. Discovery stamps both the interface count and the subnet count onto the resource, and the idle rule prices from the interface count where it can, falling back to the subnet count on the reasonable assumption of one interface per subnet.

The floor is 1 MiB, and it is a peak

RC-095 Idle VPC Interface Endpoint reads the BytesProcessed series that the metrics pipeline harvests for PrivateLink endpoints. The gate is a window peak at or below 1 MiB, not an exact zero and not a monthly total. A floor rather than zero tolerates health-check chatter on an otherwise unused endpoint. Comparing the peak rather than the sum means one genuinely busy hour disqualifies the endpoint, which is the conservative direction for a recommendation whose remedy is deletion.

Abstaining beats assuming a count

Coverage must reach 30 days on the metric before the rule will speak, which is stricter than the generic seven-day floor because the proposed action is destructive and the saving is the full endpoint cost. If the interface and subnet counts are both missing on a given endpoint, the rule abstains on that endpoint rather than assuming a single interface and understating what deletion would recover.

Separating the billable endpoints from the free ones

Listing endpoints with their type and interface count makes the priced subset obvious in one pass:

aws ec2 describe-vpc-endpoints --query 'VpcEndpoints[].{Id:VpcEndpointId,Type:VpcEndpointType,Service:ServiceName,ENIs:length(NetworkInterfaceIds)}' --output table