A platform team proposes a private endpoint for every managed service in every subscription so that no service traffic touches the public internet. There are 9 services and 40 accounts. What does the policy buy and what does it cost?

What is gained, quantified

Traffic to the managed service leaves by a private path, so there is no dependency on an internet gateway or a NAT device, no exposure to a misconfigured public bucket policy, and the flow is attributable to a named interface in your own network. For regulated workloads that attributability is often the actual requirement, written into a control rather than chosen by engineers.

There is a real cost saving in it too, and it is usually the strongest argument: traffic that would otherwise traverse a NAT device no longer pays NAT data-processing charges, which at terabyte volumes dominate the endpoint's own hourly fee.

What is paid

• An hourly charge per endpoint per availability zone, multiplied by the matrix. 9 services x 40 accounts x 3 zones is 1,080 endpoint-zone units billed hourly whether used or not, plus per-gigabyte processing. The fee is for existence, not for traffic, so sparsely used endpoints are pure cost.
• DNS becomes the hard part. A private endpoint works by resolving the service's public name to a private address inside your network, which means private hosted zones, resolver rules, and consistency across accounts. Most private-endpoint incidents are DNS incidents: a workload resolving the public name from the wrong zone and silently going out via NAT, or failing to resolve at all.
• Endpoint and interface limits per VPC, which the full matrix approaches.
• A new failure domain. The endpoint itself can be misconfigured, have a policy that denies, or be deleted by automation, and the symptom is a service that works in one account and not another.

Why the recommended option wins

Not all private connectivity costs the same. Gateway-style endpoints for object and key-value storage are route-table entries rather than billed interfaces - no hourly fee, no DNS indirection, trivial to apply everywhere - and they cover the highest-volume traffic in most estates. Interface endpoints are then reserved for the services where private reachability genuinely matters: databases, secret stores, message brokers and anything carrying regulated data. That combination gets most of the security and cost benefit for a fraction of the fee and a fraction of the DNS complexity.

Why the other options fail

• "Private endpoints everywhere." The policy in the question. It buys uniformity and pays for 1,080 billed units, an approach to interface limits, and DNS configuration in 40 places. Uniformity is a real benefit for auditability, and it is rarely worth this price.
• "A shared services account with cross-account DNS." Reduces the endpoint count substantially and is a legitimate design, at the price of cross-account resolver configuration, a shared failure domain for every account's data access, and cross-AZ transfer charges for traffic that now crosses an account boundary. Worth it at this scale for a handful of services, not as the default.
• "Keep public endpoints with TLS and identity-based policy." Defensible for many workloads - the traffic is encrypted and authorised, and the provider's endpoint is not the weak point - and it loses the NAT cost saving, the network-level attributability, and the control a regulated workload needs. It also leaves exfiltration paths that network policy would close.

When this is the wrong answer

For a single-account workload with modest volumes, private endpoints are a fee and a DNS dependency bought to satisfy a diagram. The decision rule: apply free gateway endpoints always; buy an interface endpoint when the traffic volume makes NAT charges exceed the fee, or when a control requires a private path - and nowhere else. Measure the per-service NAT processing cost first; it is usually the number that settles the argument. As a planning figure, an interface endpoint has been priced at roughly $0.01 per hour per zone plus per-GB processing on the major providers since 2023, so 3 zones is about $22 a month before any traffic - trivial once, and about $24000 a year across the 1080-unit matrix above.