wtf( )unctionsystem design, drawn
← all problemsAWS SA ProHard

The endpoint that was added, and the half of the fleet still paying to leave

The finance review flagged data processing on the NAT gateways, traced it to workers pulling objects from S3, and the fix was obvious and correct: add a gateway endpoint. It was added. It works — measurably, for some of the fleet.

The NAT charge went down by about a third and then stopped going down. The workers that still cost money are indistinguishable from the ones that do not: same image, same role, same instance type, same bucket.

Place what puts the remaining subnet's traffic on the endpoint. The endpoint itself already exists and is healthy.
Components — tap one, then tap a slot on the diagram
!A third of the expected saving, and no way to tell the expensive workers from the free ones by looking at them. The endpoint shows Available, the bucket is in this Region, and nothing errors.A gateway endpoint is not attached to a VPC. It is attached to the ROUTE TABLES you selected, and everything else keeps using the public path.

Boundaries, outermost first: Analytics VPC: Route table A (endpoint route), an empty slot for the for the subnet still paying Workers A: Worker (costs nothing) Workers B: Worker (still metered; FAILED: via NAT) Outside every boundary: NAT gateway (metered per GB), Gateway endpoint (S3, healthy) Connections: Worker calls Route table A (step 1) Route table A calls Gateway endpoint — prefix list route (step 2) Worker calls for the subnet still paying (step 3) for the subnet still paying sends outbound traffic to NAT gateway — default route (step 4) for the subnet still paying controls Gateway endpoint — select the table (step 5)

Route table Aendpoint route
Workerstill meteredvia NAT
Workercosts nothing
NAT gatewaymetered per GB
Gateway endpointS3, healthy