Zero-Trust Financial Backend: Eliminating NAT Gateway Data Fees
Securing private banking APIs and saving $3,000/month by replacing NAT Gateway S3/DynamoDB traffic with VPC Interface Endpoints and PrivateLink.
1. Business Problem & Context
A digital bank was transferring 60 Terabytes of encrypted ledger data each month from private compute instances to Amazon S3 and DynamoDB. Because compute subnets used NAT Gateways to reach public AWS endpoints, they incurred over $2,700/month in NAT data processing fees ($0.045/GB). Moreover, banking regulations required all network traffic to remain strictly within private network pathways.
2. Requirements & Constraints
- Zero Public Internet Routing: Data between compute and AWS services (S3, DynamoDB, Secrets Manager, KMS) must never leave AWS private fiber.
- Cost Optimization: Eliminate NAT Gateway data transfer surcharges.
- Envelope Encryption: Enforce Customer Managed Keys (CMK) on all stored financial payloads.
3. Architecture Overview & Data Flow
Interactive Architecture Diagram (Use controls to zoom & pan)
4. AWS Services Used & Rationales
AWS Services Architecture Rationale
Concrete reasons why these specific services were chosen over alternatives
| Service | Category | Architectural Rationale ("Why this service?") |
|---|---|---|
| VPC Gateway Endpoints (S3 & DynamoDB) | Networking | Provides free private routing directly from VPC route tables to S3 and DynamoDB with zero data transfer fees. |
| VPC Interface Endpoints (PrivateLink) | Networking | Provisions Elastic Network Interfaces (ENIs) inside private subnets for KMS and Secrets Manager access. |
| AWS KMS Customer Managed Keys | Security | Provides hardware security module (HSM) protected keys with annual rotation and CloudTrail audit trails. |
5. Key Design Trade-offs
Architecture Decision & Trade-Off Matrix
Evaluating alternative approaches under real-world constraints
NAT Gateway for All AWS API Calls
- + Simple default routing (0.0.0.0/0)
- − High data transfer costs ($0.045/GB)
- − Leaves VPC boundary logically
VPC Gateway & Interface Endpoints (Chosen)
✓ Chosen Design- + Zero data processing fee for S3 and DynamoDB
- + 100% private traffic on AWS global backbone
- + Enhanced security policy enforcement
- − Interface endpoints cost ~$7.20/mo per AZ per service
6. Implementation Highlights
IaC Recipe VPC Gateway Endpoint Route Table Policy
resource "aws_vpc_endpoint" "s3_gateway" {
vpc_id = aws_vpc.main.id
service_name = "com.amazonaws.us-east-1.s3"
vpc_endpoint_type = "Gateway"
route_table_ids = [aws_route_table.private.id]
policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Sid = "AllowOnlyOurLedgerBucket"
Effect = "Allow"
Principal = "*"
Action = ["s3:GetObject", "s3:PutObject"]
Resource = "arn:aws:s3:::bank-ledger-records-prod/*"
}]
})
}7. Results & Key Metrics
- Monthly Cost Savings: Reduced AWS bill by $2,740/month instantly.
- Regulatory Audit: Passed 100% of banking data boundary compliance checks.
8. Key Architectural Takeaways
FinOps Rule: VPC Gateway Endpoints for Amazon S3 and Amazon DynamoDB are completely free. There is never a reason to route S3 or DynamoDB traffic through a paid NAT Gateway.
