A SaaS company hosted its application in private subnets across multiple Availability Zones. The application servers communicated with several AWS managed services including Amazon S3 for document storage, AWS Secrets Manager, AWS Systems Manager Parameter Store, Amazon ECR, and AWS KMS. Since all EC2 instances resided in private subnets, outbound traffic to AWS services traversed a NAT Gateway.
Data Flow Before AWS PrivateLink
1. EC2 (Private Subnet)
↓
2. Private Route Table
↓
3. NAT Gateway
↓
4. Internet Gateway
↓
5. Public AWS Service Endpoint
Although the traffic never left the AWS backbone, every request to Secrets Manager, Parameter Store, ECR APIs, and KMS incurred NAT Gateway data processing charges ($0.045/GB in many regions), along with hourly NAT Gateway charges. The application transferred nearly 12 TB of management and API traffic every month, resulting in significant recurring costs.
Solution
The architecture was redesigned using Interface VPC Endpoints (AWS PrivateLink) for:
- AWS Secrets Manager
- AWS Systems Manager
- Amazon ECR API
- Amazon ECR DKR
- AWS KMS
Additionally, an S3 Gateway Endpoint was configured for Amazon S3 access.
Data Flow After AWS PrivateLink
1. EC2
↓
2. Interface Endpoint (Private IP)
↓
3. AWS Private Backbone
↓
4. AWS Managed Service
No NAT Gateway or Internet Gateway was involved.
Outcome
- Approximately 11.5 TB/month of traffic bypassed the NAT Gateway.
- NAT Gateway data processing charges were reduced by nearly 95%.
- Overall networking costs declined by approximately $500–700 per month, depending on regional pricing.
- Security improved because no public endpoints were accessed.
- IAM policies could enforce endpoint-specific access using
aws:SourceVpce. - Compliance teams appreciated that all communication remained entirely within the VPC and AWS private network.
The organization retained NAT Gateways only for genuine internet-bound traffic such as operating system updates and third-party APIs, while all AWS service communication moved to private endpoints, significantly reducing recurring operational costs.
