Lecture 58: VPC Gateway Endpoint
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：06:28
- 来源：Udemy Lecture 50324581
- Slide 数量：7
- 画面切换：00:04、00:22、00:46、02:47、03:37、05:25
扫描说明
逐条检查了 Udemy 页面中的 96 条 Transcript cue，并对全长 06:28 的视频画面进行扫描。最终接触表检查后重截了两张实际切换点早于字幕 cue 的画面，共识别出 7 张不同的 Slide。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. VPC Gateway Endpoint 导论
时间范围：00:00–00:04
总结 / Summary
中文
网关 VPC 端点（VPC Gateway Endpoint）为 VPC 内资源访问 S3 和 DynamoDB 提供无需公网、IGW 或 NAT Gateway 的私有路径。
English
A VPC Gateway Endpoint provides VPC resources with a private path to S3 and DynamoDB without requiring public networking, an IGW, or a NAT Gateway.
Transcript
00:00 Okay.
00:01 Now let's look at the VPC gateway endpoint to begin with.
2. Gateway Endpoint 在 Endpoint 类型中的位置
时间范围：00:04–00:22
总结 / Summary
中文
Gateway Endpoint 的实现不同于由 AWS PrivateLink 支撑的接口端点（Interface Endpoint）和其他端点。它不在子网中创建 ENI，而是通过路由表把特定服务流量导向端点。
English
Gateway Endpoints use a different implementation from Interface Endpoints and other PrivateLink-powered endpoint types. They do not create ENIs in subnets; instead, route tables direct selected service traffic to the endpoint.
Transcript
00:04 And as I said in the previous lecture, VPC gateway endpoint is little different.
00:07 The way it works as compared to the other end points like interface endpoint which are powered by private
00:14 Link.
00:14 So let's first discuss VPC endpoint quickly.
00:17 And let's also do some exercise so that you exactly know how it works.
3. Gateway Endpoint 架构：S3 与 DynamoDB
时间范围：00:22–00:46
总结 / Summary
中文
私有子网中的实例通过 Gateway Endpoint 私有访问同一区域的 S3 和 DynamoDB。创建端点时选择关联路由表，AWS 随后为目标服务的地址集合添加端点路由。
English
Instances in private subnets use a Gateway Endpoint to reach S3 and DynamoDB privately within the same Region. When the endpoint is created, selected route tables receive endpoint routes for the target service's address set.
Transcript
00:22 Okay so we are talking about the gateway endpoint.
00:25 As you can see here which is used to access Amazon S3 and DynamoDB.
00:29 These two services privately from your VPC.
00:34 Right.
00:34 And as you can see here, in order to access gateway endpoint, you have to modify the route table of
00:40 the subnet.
00:41 Right.
00:42 So in this lecture let's talk more about this gateway endpoint.
4. AWS-managed Prefix List 与 Route Table Entry
时间范围：00:46–02:47
总结 / Summary
中文
S3/DynamoDB 背后有大量动态地址，不能逐一写入路由。AWS 用托管前缀列表（AWS-managed Prefix List）聚合服务 CIDR，标识形式为 pl-xxxx。子网路由表的 Destination 使用该 Prefix List，Target 使用 Gateway VPC Endpoint；同一 Prefix List 也可在安全组中引用。
English
S3 and DynamoDB use many dynamic addresses that cannot be entered individually in routes. AWS aggregates service CIDRs into an AWS-managed Prefix List identified as pl-xxxx. The subnet route table uses that Prefix List as the destination and the Gateway VPC Endpoint as the target; the same Prefix List can also be referenced in Security Groups.
Transcript
00:46 Okay.
00:46 So it enables the private connection between VPC and S3 or DynamoDB.
00:51 And for using the gateway endpoint you have to modify the route tables so that there is an entry in
00:57 the route table which takes the traffic from the subnet to Amazon S3 or DynamoDB table.
01:03 But you must be wondering what kind of entry you will add, because for adding the route table entry,
01:08 you need to know the IP addresses of Amazon S3 and DynamoDB.
01:12 Right now these are the services which are managed by AWS, and I'm sure there isn't 1 or 2 servers
01:19 on which, say S3 or DynamoDB service will be hosted.
01:23 There will be hundreds and thousands of maybe machines on which these services are hosted.
01:29 So ideally, you should add all those IP addresses to your route table, which is not really practical,
01:36 right?
01:36 So how do you do that?
01:38 Now for that, what AWS does is it creates something called prefix list.
01:43 So it's called IP prefix list where it combines all those IP address ranges for say S3.
01:50 Or there could be a prefix list for say, DynamoDB.
01:53 So you don't need to individually add those IP addresses to your route table.
01:58 You can just add that prefix list.
02:00 So this is AWS managed prefix list.
02:03 But if you want you can also create your own custom prefix list.
02:07 But in this case because we are accessing S3 and DynamoDB services, we can use AWS managed prefix list,
02:15 right?
02:15 So as I said, it's a collection of IP addresses for these services.
02:19 And it is in the format PL dash some ID and it becomes available so that you can add it to your subnet
02:27 route table or also in your security group.
02:30 And we will see that shortly.
02:32 So your route table entry finally looks something like this where the destination is this prefix list
02:38 for S3 service.
02:40 And the target will be the gateway VPC endpoint.
02:44 Right.
02:45 So please remember this.
5. Security Group Egress、同 VPC 与同 Region 约束
时间范围：02:47–03:37
总结 / Summary
中文
如果 EC2 安全组（Security Group）不是默认允许全部出站，需要为对应 Prefix List 开放 HTTP/HTTPS 出站。Gateway Endpoint 只能由创建它的 VPC 内资源使用，并且只连接同一 AWS 区域（Region）内的 S3/DynamoDB 服务。
English
If the EC2 Security Group does not allow all outbound traffic, HTTP or HTTPS egress must be permitted to the service Prefix List. A Gateway Endpoint is usable only from resources inside the VPC where it was created and reaches S3 or DynamoDB in the same AWS Region.
Transcript
02:47 Next you also need to modify the outbound security group for the EC2 instance, which is accessing the
02:55 S3 or DynamoDB.
02:57 Right now.
02:58 By default, you know that all the outbound traffic is allowed, but in case you are using a custom
03:02 security group in which it is not allowed, then you should also open the port for https and http for
03:10 the same prefix list.
03:12 Right?
03:13 And that's where traffic can go out from EC2 instance to respective AWS service.
03:18 Further, one more important thing about VPC gateway endpoint is that they can be accessed from within
03:24 the same VPC in which you have created it, and you can only access the AWS services in the same region.
03:30 Now, if you see this architecture, I have region, I have VPC and there is a gateway endpoint there
6. Remote Networks 不能穿过 Gateway Endpoint
时间范围：03:37–05:25
总结 / Summary
中文
Gateway Endpoint 不创建可路由的 ENI，只依赖 VPC 子网路由表，因此本地网络经 VPN/Direct Connect 或另一个 Peered VPC 不能借用该端点访问 S3/DynamoDB。这类远程网络访问通常需要接口端点（Interface Endpoint）等具有私有 IP 的方案。
English
A Gateway Endpoint creates no routable ENI and depends on VPC subnet route tables, so an on-premises network connected through VPN or Direct Connect, or another peered VPC, cannot use it to reach S3 or DynamoDB. Remote-network access generally requires a private-IP solution such as an Interface Endpoint.
Transcript
03:37 which connects the VPC to S3.
03:40 And then this VPC is connected to Corporate Data center via VPN or Direct Connect.
03:45 And also I have VPC peering connection to another VPC.
03:49 Now the question is from my on premise data center or from the peered VPC.
03:55 Can I access S3 via this gateway endpoint?
04:00 Now here is the trick.
04:03 In general, if the given endpoint is having, say, a Eni into your VPC provisioned, then most probably
04:13 you can do that because your traffic is landing into VPC and from there it can go to a respective destination.
04:22 But as you understand the VPC gateway endpoint, there is no Eni created.
04:26 Now that is true for interface endpoint.
04:28 And that's what we are going to see in the next lectures.
04:31 But in case of gateway endpoint there is no any that you manage.
04:35 You just modify your route table of your VPC and that's it.
04:39 You get that connection to S3.
04:42 Now in this case, if traffic is flowing from VPN or DD, it does not know where to go because the route
04:48 table is for your subnet.
04:50 It is not for the traffic coming from VPN.
04:53 And that's why the in this case, you can't access this S3 bucket via this gateway endpoint.
05:00 So the connection from the VPC is not allowed.
05:05 Similarly, if the traffic originate in on premise data center, it cannot flow through the gateway
05:12 endpoint to S3.
05:13 This is also not supported.
05:15 So these are invalid scenarios for accessing S3 or DynamoDB using the gateway endpoint.
05:23 So remember that.
7. Gateway Endpoint 免费并应优先用于 S3/DynamoDB
时间范围：05:25–06:28
总结 / Summary
中文
视频说明 Gateway Endpoint 没有按小时或流量处理的端点费用，因此当 VPC 内应用访问 S3/DynamoDB 时应优先采用。它减少 NAT Gateway 成本与公网路径；随后课程将通过实操展示配置，并再讨论 Endpoint Policy 等安全控制。
English
The video explains that Gateway Endpoints have no hourly or endpoint data-processing charge, so they should be preferred when applications inside a VPC access S3 or DynamoDB. They reduce NAT Gateway cost and public routing; the following material demonstrates configuration and then covers security controls such as endpoint policies.
Transcript
05:25 Okay.
05:26 And finally one more important thing about the gateway endpoint is that it's free to use.
05:31 So there is no charge for, you know, how many hours you create that gateway endpoint or the traffic
05:38 that flows between, say, EC2 and S3?
05:40 Because VPC and AWS services are in the same AWS region.
05:46 And that's where it's recommended that you always use VPC gateway endpoint whenever your application
05:52 has to access, say, Amazon S3 or DynamoDB.
05:56 Okay.
05:56 So that's it about VPC gateway endpoints.
05:59 And before we get into say, security of the gateway endpoint and some other things, let's first do
06:06 a quick demo where you will see how exactly it works.
06:09 And then we will cover VPC interface endpoint which works differently than the gateway endpoint.
06:15 And then we will see the security aspects of the endpoint because it's common for both gateway and the
06:20 interface endpoint.
06:22 So with that let's stop for this lecture and let's go to the next lecture.
06:26 Thank you.
整讲总结 / Overall Summary
中文
Gateway Endpoint 通过 AWS 托管前缀列表（AWS-managed Prefix List）和路由表，为同一 VPC、同一区域内的 S3/DynamoDB 流量提供私有路径。它不创建 ENI、不能从 VPN、Direct Connect 或 Peered VPC 远程借用，但没有端点使用费。正确配置还需检查路由表关联和安全组（Security Group）出站规则。
English
A Gateway Endpoint uses AWS-managed Prefix Lists and route tables to provide private S3 or DynamoDB access from the same VPC and Region. It creates no ENI and cannot be used remotely through VPN, Direct Connect, or a peered VPC, but it has no endpoint usage charge. Correct configuration also requires route-table association and appropriate Security Group egress.
返回顶部 ↑