verify gateway endpoint functionality

Question

I designed my architecture to be HIPAA compliant by routing data within AWS in the following manner
- deployed lambda in a VPC 
- interface endpoints for bedrock and SQS 
- gateway endpoint for dynamodb.

For the interface endpoints, i was able to verify 'local' data transmission since the DNS resolution showed IP belonging to the same subnet. However, I couldn't verify this for the gateway endpoint; DNS resolution for `dynamodb.us-west-2.amazonaws.com` showed a public IP (even though the route was added to the VPC). Is there a way I can ensure (and show the client) that data indeed hasn't left AWS just like I can for SQS and bedrock?

P.S. The lambda does have public internet access for some reasons.

re:Post Agent · Answer

To verify the functionality of your DynamoDB gateway endpoint and ensure that data is indeed staying within the AWS network, you can follow these steps:

1. Check the route table associated with your VPC subnets: Ensure that there's a route for the DynamoDB service prefix list (pl-xxxxxxxx) pointing to the gateway endpoint (vpce-xxxxxxxx).

2. Use the 'nslookup' or 'dig' command from an EC2 instance within your VPC to resolve the DynamoDB endpoint (dynamodb.us-west-2.amazonaws.com). It's normal to see a public IP address in the result, as gateway endpoints use public IP addresses for routing.

3. To confirm that traffic is actually using the gateway endpoint, you can use VPC Flow Logs. Enable flow logs for your VPC and analyze the traffic. You should see traffic to DynamoDB's IP addresses, but the source and destination will be private IP addresses within your VPC CIDR range.

4. Use the AWS CLI to test the connection to DynamoDB from within your VPC. Run a simple command like 'aws dynamodb list-tables' from an EC2 instance in your VPC. If it succeeds, it's using the gateway endpoint.

5. Monitor CloudWatch metrics for your gateway endpoint. Look for metrics like "BytesIn" and "BytesOut" to confirm that traffic is flowing through the endpoint.

6. You can also use AWS Reachability Analyzer to create and analyze a path between your Lambda function (or an EC2 instance in the same subnets) and DynamoDB. This will show you the exact path the traffic takes, confirming it goes through the gateway endpoint.

By following these steps, you can demonstrate to your client that the data is indeed staying within the AWS network, even though the DNS resolution shows a public IP. The key is that the routing occurs at the VPC level, directing traffic through the gateway endpoint rather than over the public internet.  
**Sources**  
[Troubleshoot connection to AWS service endpoints from Linux | AWS re:Post](https://repost.aws/knowledge-center/linux-troubleshoot-service-endpoints)  
[Infrastructure security in Amazon DynamoDB - Amazon DynamoDB](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/network-isolation.html)  
[Getting started with Reachability Analyzer using the AWS CLI - Amazon Virtual Private Cloud](https://docs.aws.amazon.com/vpc/latest/reachability/getting-started-cli.html)

verify gateway endpoint functionality

Relevant content