S3 Gateway vs Interface Endpoint for On-Premises Access

Two S3 endpoint types look interchangeable in a design review and behave nothing alike once the client sits off site. A gateway endpoint is a route-table integration inside a VPC, so a request from a site VPN never arrives at it as a private destination. An interface endpoint puts private addresses on network interfaces, which is something a hybrid path can actually reach. Everything that follows depends on which of those two you picked.

Decide by the Network Entry, Not the Service Name

Start from where the traffic originates, because that is the question the endpoint type answers. A workload in a supported VPC context can use a gateway endpoint and never needs a private address of its own. A workload on premises needs a private address it can route to, which is what an interface endpoint provides. If a design mixes both, both endpoint types can coexist in one VPC, and that is a normal arrangement rather than duplication.

Mixing them is not the problem. Assuming one type covers the other is.

Classify the client before choosing anything. A workspace inside the VPC, a container behind a NAT gateway and an application in a branch office are three different sources, and only the last one forces the hybrid entry. Write that classification next to the endpoint inventory so the next reviewer sees why each endpoint exists.

What the Interface Path Requires End to End

An interface endpoint grants reachability to private addresses, and reachability is one of four requirements. The on-premises network needs a route to those addresses, the VPC side needs a return path, the endpoint's security group must admit the source range, and any inspection appliance between the two must allow the flow. A route to some instance in the VPC proves none of the four.

Work from the far end backwards. Confirm the endpoint's network interfaces exist in the subnets you expect, then confirm its security group admits the real on-premises range rather than a placeholder. Then check the tunnel or circuit carries the return path in the same direction. Inspection is the step people skip, because a middlebox that permits the connection can still drop a larger response body, and that looks like a throughput problem instead of a policy one.

Test with the smallest authorized operation available rather than a large download. The failure shows up sooner and with less traffic to account for.

DNS Follows the Query Source, Not the VPC

An endpoint that exists does not redirect anything by itself. The application receives whatever name its resolver returned, and the resolver answers according to the view it is allowed to see. An instance inside the VPC and a laptop in the office ask two different questions and can both get correct, different answers. Verifying one and concluding the other is how a passing test becomes a failing deployment.

Read the endpoint's private DNS setting as part of the design, not as a checkbox to enable after go-live.

If the office resolver has to see the VPC's view, that path must be built on purpose, commonly through a resolver inbound endpoint. Query from the application's own context and note which resolver replied. A result gathered on a bastion host inside the VPC describes the bastion's view and nothing else.

Permission Is Separate From Reachability

A reachable endpoint returns errors for requests the principal is not allowed to make, and that error means the system is working as designed. Identity policy, bucket policy and any endpoint policy are evaluated in their own layers. Network access has never granted a permission.

Accept the design on two results: a harmless authorized call that succeeds, and an expected denial for an excluded identity or bucket.

aws ec2 describe-vpc-endpoints --filters Name=vpc-id,Values=vpc-0123456789abcdef0
dig +short s3.us-west-2.amazonaws.com @10.0.0.2

Record the endpoint name, the resolved destination and the policy context beside each result, because one later DNS change can invalidate the whole conclusion. Compare the current cost and operational weight of both endpoint types before provisioning anything. An interface endpoint buys a hybrid private entry, it is not a universal requirement, and the gateway path often remains the better answer for workloads inside the VPC. The choice is per client and it stays revisitable.