VPC Endpoint monitoring question

To check usage and monitoring of VPC endpoints before deletion, you have several effective methods:

1. CloudWatch Metrics: You can monitor VPC interface endpoints using CloudWatch metrics. Navigate to the Amazon VPC console, select "Endpoints" in the navigation pane, choose your endpoint, and then view the "Monitoring" tab. Key metrics to review include:

• PacketsDropped: Indicates if the endpoint is dropping packets
• RstPacketsReceived: Shows if the endpoint is receiving RST packets
• Active connections and bytes processed

2. CloudTrail Network Activity Events: This provides comprehensive visibility into AWS API activity passing through your VPC endpoints. By enabling network activity events in CloudTrail, you can see both control plane and data plane actions traversing the endpoints, which helps determine if they're actively being used.

3. VPC Flow Logs: These capture information about the IP traffic going to and from network interfaces in your VPC, which can help identify if traffic is flowing through the endpoints.

4. CloudTrail API Logs: Review CloudTrail logs for API calls related to the VPC endpoints to see historical creation, modification, or usage patterns.

The CloudWatch metrics approach you found is indeed one of the best ways to check endpoint usage. By examining metrics like active connections and data transfer over a period (e.g., 2-4 weeks), you can determine if endpoints are truly unused.

Before deletion, I recommend:

1. Monitor the endpoints for a sufficient period
2. Review CloudTrail logs for any API activity through these endpoints
3. Consider temporarily restricting access via endpoint policies rather than immediate deletion to ensure no unexpected dependencies exist
   Sources
   Community | Monitor VPC interface endpoints with CloudWatch
   CloudWatch metrics for AWS PrivateLink - Amazon Virtual Private Cloud
   AWS CloudTrail network activity events for VPC endpoints now generally available | AWS News Blog
   Monitoring your VPC - Amazon Virtual Private Cloud

You can monitor and determine usage of VPC Interface endpoints using CloudWatch metrics. A couple of metrics you could monitor are ActiveConnections and BytesProcessed. From the AWS doc, below are the descriptions for these metrics [https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-cloudwatch-metrics.html#endpoint-service-metrics-dimensions]

1. ActiveConnections -The maximum number of active connections from clients to targets through the endpoints.

2. BytesProcessed - The number of bytes exchanged between endpoint services and endpoints, in both directions.

Both metrics can give a good reference to determine if the endpoint is in use or otherwise.

If you would like to take it a step further to check the IPs/clients communicating with the interface endpoints, you could use VPC flow logs. You can setup VPC flow logs to log traffic on the Interface Endpoint ENIs.

Regarding Gateway endpoints, metrics are not published for gateway endpoints. Referenced in AWS doc [https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-cloudwatch-metrics.html]

You could also leverage VPC flow logs here. Since there is no ENI for Gateway endpoints, you could log traffic on the other source ENIs within the VPC. Gateway endpoints are supported for S3 and DynamoDB only, hence you could check from the logs if the destination IPs belong to S3 or DynamoDB. Cross check if the source subnet’s route tables are associated with a Gateway endpoint of the respective service (S3 or DynamoDB). If sources within the VPC are sending traffic to S3 or DynamoDB IPs and their respective route tables are associated with the Gateway endpoint, then the Gateway endpoint is being used.