Start by identifying the endpoint type. A gateway endpoint and an interface endpoint use different network paths, so the same DNS, route-table, and security-group checks do not apply to both. An endpoint marked Available is provisioned; that status alone does not prove that a request can reach the service or is authorized. For a broader review of VPC routes and security controls, see the AWS VPC configuration guide.

Start with the endpoint and the failing request

  1. Record the endpoint ID, service name, Region, endpoint type, and status. Also note the client subnet and Availability Zone, the hostname and port the application uses, the time of failure, and the exact error.
  2. Check whether the problem affects every client or only one subnet, Availability Zone, account, or API action. That split helps distinguish a shared endpoint issue from a client path or permission issue.
  3. Follow the gateway or interface checks below. Test name resolution and network reachability before changing access policies.

Use the AWS CLI to inspect an endpoint. Replace the example ID and Region with your values:

aws ec2 describe-vpc-endpoints \
  --vpc-endpoint-ids vpce-0123456789abcdef0 \
  --region us-east-1

Review VpcEndpointType, ServiceName, State, and, for an interface endpoint, SubnetIds, Groups, PrivateDnsEnabled, and DnsEntries. The AWS CLI reference lists the command options and response fields. If the endpoint is still pending, failed, rejected, or pending acceptance, resolve that provisioning or service-owner issue before debugging the application path.

Check the path for the endpoint type

Gateway endpoints: route tables, security rules, and policy

Gateway endpoints are available for Amazon S3 and DynamoDB. They do not create endpoint network interfaces or use endpoint security groups. They use the service’s standard DNS names and route traffic to its service addresses. When you associate a gateway endpoint with route tables, AWS adds a route whose destination is the service-managed prefix list and whose target is the endpoint ID. Check that the route table associated with the client subnet is selected on the endpoint and contains that route for the service and Region the client uses. A route in another subnet's table does not help this client.

Security groups still apply to the client. Their outbound rules must allow the service traffic; subnet network ACLs must allow the request and return traffic. A network ACL cannot reference a prefix list, so use the service's current address ranges when writing NACL rules. Check the endpoint's Region and the request's destination address family as well as the route itself.

A gateway endpoint is usable from its VPC. It does not extend to clients reached through VPC peering, a transit gateway, VPN, or Direct Connect. For those network paths, choose a supported interface endpoint design instead. AWS describes these limits and the route behavior in its gateway endpoint guide.

Once the route works, check authorization separately. A request can be blocked by the endpoint policy, the caller's IAM policy, or the service's resource policy (such as an S3 bucket policy). An endpoint policy is an additional boundary; it does not grant permissions or replace the other policies. Some services do not support endpoint policies. See AWS's guide to VPC endpoint policies.

Interface endpoints: DNS and endpoint network interfaces

An interface endpoint places an elastic network interface in each selected subnet, with a private IP address from that subnet. Clients connect to those endpoint ENIs. Record the selected endpoint subnets, Availability Zones, ENIs, and IP addresses. A client can use an endpoint ENI in another Availability Zone; an endpoint in every client Zone is not a connectivity requirement. Multiple endpoint Zones can improve availability and help avoid cross-Zone traffic. For access from another VPC or on-premises network, also verify that the network route reaches the endpoint subnet and that the DNS design returns usable endpoint addresses to those clients.

When a service supports private DNS and it is enabled, the service's usual Regional hostname resolves to the endpoint's private IP addresses inside the associated VPC. It requires both DNS resolution and DNS hostnames to be enabled for the VPC. Check the service documentation for exceptions: for example, the DynamoDB PrivateLink guide directs clients to the generated endpoint URL and warns against private DNS overrides for the standard DynamoDB hostname. Check the name the application actually requests and resolve it from the same host or network path:

getent hosts SERVICE_REGIONAL_HOSTNAME

Replace SERVICE_REGIONAL_HOSTNAME with the service hostname used by the application. For a service hostname covered by ordinary interface-endpoint private DNS, the response from inside the VPC should include the endpoint ENI addresses. S3 has an important exception: with private DNS only for inbound Resolver endpoints, in-VPC clients continue to use the S3 gateway endpoint, while queries through the inbound Resolver return interface-endpoint addresses. A public S3 address in that setup can be expected; check the S3 PrivateLink DNS configuration before treating it as a failure. The endpoint-specific DNS names listed by describe-vpc-endpoints are another way to test the interface endpoint directly. If you use custom DNS, check the forwarding rules and private hosted zone behavior. On-premises clients generally need Route 53 Resolver inbound endpoints, with their on-premises DNS servers forwarding the relevant queries to those endpoints; the VPC's Amazon-provided resolver is not directly usable from outside the VPC. AWS explains these PrivateLink DNS behaviors.

Interface endpoints: security groups and network ACLs

The security group attached to the endpoint ENIs controls traffic arriving at those interfaces. Allow inbound traffic on the service's documented port, commonly TCP 443 for AWS APIs, from the client sources. The client security group must also allow the corresponding outbound traffic if its egress rules are restricted.

Network ACLs are stateless. Check both the client subnet and endpoint subnet: allow the request to the service port and the return packets to the client's ephemeral source port. Use the port range configured for the client operating system or appliance instead of assuming one universal ephemeral range. Route tables do not need a special endpoint target for interface endpoints; within a VPC, traffic to an endpoint ENI normally follows the VPC's local route. AWS documents the ENI and security-group configuration in its interface endpoint guide.

Separate network failures from access denials

A timeout or failed TLS connection points first to DNS, the selected endpoint IP, routing, security groups, NACLs, or endpoint availability. An HTTP response such as 403 or an AWS AccessDenied error means the request reached an AWS endpoint far enough to receive an application response; investigate the caller's credentials and IAM permissions, resource policy, endpoint policy, and service-specific conditions. A successful TCP connection does not prove that the API action is authorized or that the resource exists.

For an interface endpoint, a basic TCP check can separate a blocked port from a later TLS or API error. Replace the placeholders with an endpoint ENI address and the service port:

nc -vz ENDPOINT_ENI_IP SERVICE_PORT

Then use the service's normal client or API against the hostname configured for the application. Keep the hostname in the request so TLS and service routing use the expected name.

Use network evidence to narrow the fault

Flow Logs and Reachability Analyzer

VPC Flow Logs can show IP flow records for a client or endpoint ENI. Filter around the test time and check the source and destination addresses, ports, and ACCEPT or REJECT action. A reject is evidence of a VPC-level network control rejecting the flow; an accepted record does not prove that the service completed the API request. Flow Logs are not packet captures, can be delayed, and do not record every kind of traffic, including queries to the Amazon-provided DNS resolver.

VPC Reachability Analyzer can analyze supported IPv4 paths from a source resource to a VPC endpoint or endpoint ENI and identify route-table, security-group, or NACL configuration that blocks them. It does not send packets or test DNS answers, IAM authorization, TLS, or the service itself. For packet-level evidence after these checks, see VPC Traffic Mirroring and packet capture.

Check endpoint and service quotas when creation fails

If an endpoint cannot be created or a subnet cannot be added, read the endpoint's failure details and compare the affected account and Region with current VPC endpoint quotas in Service Quotas. Interface endpoint ENIs consume subnet addresses and are created for selected Availability Zones, so check available addresses in each selected subnet too. Do not delete service-managed ENIs manually to make room; change the endpoint configuration or request an adjustable quota increase through the supported process. AWS publishes current values in the AWS PrivateLink quotas page.

Record the evidence before changing configuration

Keep the endpoint ID and type, service and Region, client subnet and Availability Zone, DNS answer, destination IP and port, endpoint state, route table, security groups, NACLs, and the exact application error together. This lets you distinguish a route or DNS problem from an endpoint policy or service authorization failure without widening network access as a blind test. Recheck with the same client and request after each targeted change.