Reduce NAT Gateway costs by keeping S3 traffic on VPC Endpoints
Create a resource control policy (RCP) that prevents accessing S3 except through a VPC Endpoint. This reduces the traffic going over AWS NAT Gateway and helps save you money.
On 8/29/2025, AWS announced (AWS What's New) new IAM global condition keys that can be used to ensure all traffic going to Amazon S3 traverses an AWS PrivateLink VPC Endpoint. If you have not created VPC Endpoints, and your resources in private VPC subnets need to access S3, the network traffic will be going out through an AWS NAT Gateway. This can lead to excessive networking costs for traffic that can remain on the AWS backbone.
To use these new condition keys, you'll first need to set up an AWS Organization (AWS Documentation) so you can use the Resource Control Policy (AWS Documentation) (RCP) feature.
With RCP's, you can create a
Deny policy that effects AWS resources within your organization. In this example, we'll be creating an RCP that effects all of the S3 buckets, in all regions, in all of the member AWS Accounts within the organization (RCPs only support a subset of AWS services, but more will be added over time).Note: RCP's do not govern the management (or payer) account within your organization. They only effect the member accounts in the organization.
Below is an example resource control policy that will require all access to S3 to traverses through a VPC Endpoint.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
{
"Sid": "EnforceNetworkPerimeter",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": "*",
"Condition": {
"StringNotEqualsIfExists": {
"aws:PrincipalTag/dp:exclude:network": "true",
"aws:VpceOrgID": "o-YOURORGID"
},
"BoolIfExists": {
"aws:PrincipalIsAWSService": "false",
"aws:ViaAWSService": "false"
}
}
}You'll want to replace
o-YOURORGID in the policy example above with your organization ID.This policy includes additional IAM condition keys that allow you to tag your IAM principals (IAM Users or IAM Roles) with a key of
dp:exclude:network and a value of true to exclude them from this policy.There is no additional cost for using a Gateway endpoint for Amazon S3 (AWS Documentation), so it is recommended to deploy them in all of your VPC and subnet route tables that need to access S3.
Additional RCP examples are available at https://github.com/aws-samples/data-perimeter-policy-examples
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article