Private access to services
Gateway VPC endpoints vs Virtual network service endpoints
Gateway VPC endpoints (for S3 and DynamoDB) map most closely to Azure virtual network service endpoints.
Both are free, use route or subnet configuration rather than an IP in your network, and let the service lock access to your network.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | Gateway VPC endpoints | Virtual network service endpoints |
| Lifecycle | Generally available | Generally available |
| What it is | Free route-table targets that give a VPC private access to Amazon S3 and DynamoDB without an internet or NAT gateway. | Free subnet setting that routes traffic to supported Azure services (such as Storage and SQL) over the Azure backbone using the subnet's identity, so the service firewall can allow that subnet. |
| Pricing model | Free. | Free. |
| Docs | Gateway VPC endpoints docs | Virtual network service endpoints docs |
| Pricing page | Gateway VPC endpoints pricing | Virtual network service endpoints pricing |
| Exams | SAA-C03 ANS-C01 Retiring | AZ-104 AZ-700 |
Key differences
- Mechanism. A gateway endpoint adds a prefix-list route to your route tables, and bucket policies can require the endpoint. A service endpoint tags traffic with the subnet identity, and the service's firewall allows that subnet.
- Coverage. Gateway endpoints cover only S3 and DynamoDB. Service endpoints cover more Azure services (such as Storage, SQL, Key Vault, and Cosmos DB). Standard service endpoints add network identifiers and network security perimeter integration for some services.
- On-premises. Neither works from on-premises networks. Use interface endpoints or private endpoints for that.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Free. Gateway VPC endpoints pricing →
- Azure
- Free. Virtual network service endpoints pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Solutions Architect – Associate SAA-C03 | AWS | Associate | current Italian version retires after Dec 31, 2026. |
| AWS Certified Advanced Networking – Specialty ANS-C01 | AWS | Specialty | retiring The exam is being retired. The last day to take it is Dec 31, 2026. Existing certifications stay active for their three-year period. |
| Microsoft Certified – Azure Administrator Associate AZ-104 | Azure | Associate | current |
| Microsoft Certified – Azure Network Engineer Associate AZ-700 | Azure | Associate | current |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of Gateway VPC endpoints?
Gateway VPC endpoints (for S3 and DynamoDB) map most closely to Azure virtual network service endpoints. Both are free, use route or subnet configuration rather than an IP in your network, and let the service lock access to your network.
How does pricing compare between Gateway VPC endpoints and Virtual network service endpoints?
AWS: Free. Azure: Free. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Solutions Architect – Associate (SAA-C03); AWS Certified Advanced Networking – Specialty (ANS-C01) [retiring]; Microsoft Certified – Azure Administrator Associate (AZ-104); Microsoft Certified – Azure Network Engineer Associate (AZ-700).