VpcEndpoint-Hours: what interface endpoints cost

What it costs

US East (N. Virginia); other regions differ. Checked 2026-11-04. Sources: AWS PrivateLink pricing, AWS docs: gateway endpoints, AWS price list file, VPC, us-east-1.

Example with made-up numbers

Typical causes

Endpoints in every AZ for every service

Each interface endpoint creates a network interface per AZ you select, and each bills hourly even with no traffic.

Endpoints for services that barely get called

An endpoint for a service used a few times a day costs the same hourly fee as a busy one.

Endpoint and NAT both in place

Teams add interface endpoints but keep the NAT, so they pay for both; the saving only appears when traffic actually moves to the endpoint.

Leftover endpoints from experiments

Endpoints created for a test or a retired service stay in the VPC and bill every hour.

The fix, step by step

Verify first

Check these before you change anything: the steps below are suggestions, and only you can see your own configuration.

• For each interface endpoint, check bytes processed (CloudWatch AWS/PrivateLinkEndpoints BytesProcessed) and compare the monthly hourly fee against what the same bytes would cost through the NAT gateway.
• Check which AZs the endpoint spans; fewer AZs lowers the hourly fee but a workload in an AZ without an endpoint network interface may cross AZs to reach it, which adds regional data-transfer charges.
• Make sure S3 and DynamoDB use gateway endpoints (no additional charge), not interface endpoints, unless a requirement forces otherwise.
• Check that no service in the VPC relies on a private DNS name from an endpoint before deleting it.

In the console

1. VPC console > Endpoints; sort by service name and read Type (Gateway or Interface).
2. Open an interface endpoint > Monitoring tab; read bytes processed over the last weeks.
3. For S3 and DynamoDB, create a Gateway endpoint instead and attach the private route tables.
4. To trim: Actions > Manage subnets and remove AZs not used by workloads, or delete endpoints that carry no traffic.
5. Check the daily VpcEndpoint-Hours line in Cost Explorer after the change.

With the CLI

aws ec2 describe-vpc-endpoints --query 'VpcEndpoints[].[VpcEndpointId,VpcEndpointType,ServiceName,SubnetIds]' --output table

aws ec2 modify-vpc-endpoint --vpc-endpoint-id vpce-EXAMPLE --remove-subnet-ids subnet-EXAMPLE

aws ec2 delete-vpc-endpoints --vpc-endpoint-ids vpce-EXAMPLE

Rollback

Recreate the endpoint with the same service name and subnets, and restore its private DNS setting. Record the endpoint's settings before deleting it.

Find your endpoint lines in your own bill

Drop in your Cost Explorer or CUR CSV. Billtrim reads it in your browser, finds the endpoint and NAT lines and shows the dollars and steps for your numbers.

Get my ranked savings list See a sample result

Paste your export: how to export a Cost Explorer CSV or CUR file in two minutes.

Questions people ask

Are VPC endpoints free?

Gateway endpoints for S3 and DynamoDB have no additional charge (AWS docs). Interface endpoints bill hourly per AZ plus per GB processed.

Does an interface endpoint replace a NAT gateway?

Only for traffic to the AWS services you create endpoints for. Traffic to the wider internet still needs a NAT gateway or another route.

Why is the hourly fee per AZ?

An interface endpoint creates one network interface per AZ you select, and AWS charges per hour for each.

Related

• NatGateway-Bytes: the NAT Gateway data-processing line
• NatGateway-Hours: the fixed monthly cost of each NAT gateway
• DataTransfer-Regional-Bytes: cross-AZ traffic on your bill

Part of the guide: Reduce AWS NAT Gateway cost: six checks, in order