Private Connectivity

Two things make this attractive and they are often conflated. The security argument is that traffic never traverses the public internet and the service is not reachable from it. The cost argument is that private paths frequently avoid the NAT gateway and internet egress charges that dominate many cloud network bills — which for high-volume storage or database traffic can be the larger of the two benefits.

The mechanism worth understanding is the endpoint model, because it has a property that VPC peering does not: an endpoint projects a single service into the consumer's network as an address, with traffic flowing one way only. The provider gains no visibility of or access to the consumer's network. That asymmetry is what makes it suitable for exposing a service to customers or partners, where peering would be unacceptable because it joins two networks and requires non-overlapping address ranges.

The trade-offs to plan for. Endpoints are typically per-service and per-region, so a large estate accumulates a lot of them, each with a cost and a DNS configuration that must resolve correctly — split-horizon DNS being the usual source of confusion when connectivity fails inexplicably.

The design question worth asking: is this being adopted for the security property, the cost property, or a compliance requirement? The answer determines how much of the estate needs it, and blanket adoption is expensive in both money and operational complexity.