What are the recommended VPC/Gateway endpoints for various AWS Services?

 

This is one of the most frequently tested networking concepts in AWS AI Professional, AWS Solutions Architect, and AWS Developer exams. The confusion comes from the fact that both provide private access, but they work very differently.

Why do we have two types of VPC Endpoints?

AWS has hundreds of managed services.

Not all services communicate in the same way.

Some services (like Amazon S3 and Amazon DynamoDB) are massive regional storage services that use a different networking architecture than services such as Amazon Bedrock, Amazon Secrets Manager, or Amazon CloudWatch.

As a result, AWS provides two endpoint types:

Endpoint Type Used For Example Services

Gateway Endpoint High-throughput regional storage services Amazon S3, Amazon DynamoDB

Interface Endpoint (AWS PrivateLink) Most other AWS services Amazon Bedrock, Secrets Manager, CloudWatch, Systems Manager, KMS, SageMaker Runtime

AWS Multi-language Call Center Assistant Use case

Business Problem

Customer uploads voice.

Need

Speech

↓

Translate

↓

Summarize

↓

Generate response

↓

Speech output

Architecture

Voice

S3

Lambda

Transcribe

Bedrock

Translate

Polly

Customer

Flow

Audio uploaded

↓

Amazon Transcribe

↓

Text

↓

Bedrock summarizes

↓

Translate

↓

Amazon Polly speaks

↓

Return audio

Services

S3

Lambda

Transcribe

Bedrock

Translate

Polly

Why Not Let LLM Process Audio?

Foundation models are text-based unless using multimodal models.

AWS speech services provide better accuracy and lower cost.

Decision Matrix (Exam Favorite)

Requirement Best AWS Service Why

Store documents S3 Durable, scalable object storage

OCR Textract Structured text extraction

Semantic search Bedrock Knowledge Bases Managed RAG

Generate embeddings Bedrock Managed embedding models

Business logic Lambda Serverless orchestration

REST API API Gateway Secure API front door

User authentication IAM / Amazon Cognito Secure access control

Structured data DynamoDB Low-latency NoSQL storage

Logs CloudWatch Monitoring and troubleshooting

Voice to text Transcribe Automatic speech recognition

Text to speech Polly Natural speech synthesis

Translation Translate Neural machine translation

Architecture Selection Cheat Sheet

Scenario AWS Architecture Pattern

Chat with enterprise documents S3 → Knowledge Base → Bedrock → Lambda

Customer support with live order data API Gateway → Lambda → Database → Bedrock

Invoice processing S3 → Lambda → Textract → Bedrock → DynamoDB

Personalized recommendations API Gateway → Lambda → DynamoDB → Bedrock

Voice assistant S3 → Transcribe → Bedrock → Translate → Polly

Key exam takeaway

A recurring pattern in AWS AI architectures is to let managed AWS services perform specialized tasks (for example, Textract for OCR, Transcribe for speech-to-text, or Knowledge Bases for retrieval) and use AWS Lambda to orchestrate workflows, retrieve business data, and enforce authorization. Amazon Bedrock is then used primarily for generative AI tasks such as summarization, question answering, content generation, or reasoning, rather than directly accessing enterprise systems or replacing specialized AI services. This separation of responsibilities is a common design principle tested in AWS AI Professional certification scenarios.