How to setup interface VPC endpoints in a multi tier architecture?
Customer want to use an interface VPC endpoint (for Cloudwatch logs specifically). Their main driver is that they want to reduce NAT gateway usage charges. Now they have a VPC with 4-tiers of subnets (Public, Web, App, database). Each tier can access/route to the lower tier only. What is the best practice to set this up from a cost/security perspective?. They currently don't use Transit Gateway or a multi-VPC/account architecture
- 4 interface endpoints per network tier?
- Create a new tier (lets say vpc endpoint tier) and centralize the VPC endpoint there?
- Something else?
In this scenario, #2 option would be better, where you create a new "tier" similar to a network services VPC design. No need to add multiple sets of interface endpoints.
In regards to the potential future state, you may want to consider an actual network services VPC depending on the number of VPCs and VPC endpoints you need. It is simple enough to change down the road if you end up needing a network services VPC to host the VPC endpoints though, so I would not start out with that design.
Refer to Centralized access to VPC private endpoints in the Whitepaper.
Relevant questions
Benefits to S3 cross-region access with VPC peered interface endpoints vs. public internet using NAT gateways?
Accepted Answerasked 5 months agoHow do I create a VPC Endpoint for S3 Interface?
asked 6 months agoS3 Interface Endpoint
Accepted Answerasked 7 months agoBest way to manage access to a VPC Endpoint
Accepted Answerasked 2 years agoReducing VPC Endpoint costs - deploying an image to Amazon ECS with CodePipeline
asked 4 months agoSQS interface endpoint for cross region access
Accepted Answerasked 2 years agoHow to setup interface VPC endpoints in a multi tier architecture?
Accepted Answerasked 2 years agoVPC Interface Endpoint Limitation on one subnet per Availability Zone for "Enable Private DNS Name"
Accepted Answerasked 5 years ago[EC2.10] Service endpoint for Amazon EC2 needs to be created for each VPC.
Accepted Answerasked 5 months agoWhich connection method when using SageMaker Notebook through VPC Interface Endpoint?
Accepted Answer