Private Endpoint
also called PrivateLink, VPC Endpoint
A private network address inside your VPC that reaches a managed service directly, without traversing the internet or a NAT gateway.
By default, a workload in a private subnet calling object storage or a managed database goes out through a NAT gateway to a public endpoint. That path costs NAT processing charges per gigabyte, adds a hop, and sends traffic over the public network even though both ends belong to the same provider.
A private endpoint places an interface in your subnet that routes directly to the service. Three benefits at once: lower cost (NAT charges avoided, often the largest saving), better security (traffic never leaves the provider network, and the service can be restricted to accept only that endpoint), and simpler egress rules, because the destination no longer needs to be allow-listed on the internet path.
They also work in reverse: exposing your own service to a customer's VPC privately, which is the usual mechanism for SaaS integrations that cannot traverse the internet.
The cost is a per-endpoint hourly charge, so they are worth it for high-volume services rather than every service.