Unused VPC Interface Endpoints: About $22 a Month Each, and Why Deleting One Is Risky

We are diving into a stack of cloud billing reports today, and our mission is simple. Uncover the hidden AWS costs, quietly draining your budget. Yeah, and these are the costs that just hide in plain sight. Right, because, you know, the cloud promises you only pay for what you actually use. Spin up a server, pay for compute, but what if you are paying just to keep a door open that nobody is ever walking through?

Exactly, and today we are looking at a surprising reality hiding inside your AWS infrastructure. The quiet cost of unused VPC interface endpoints, or, you know, AWS PrivateLink. Which is wild, because my instinct as an engineer is to say, well, aren't endpoints just network plumbing? It feels like paying rent on an empty toll booth. Like, why do we care if no cars are driving through?

A toll booth is close, but it is actually more like paying for a private underground tunnel. Oh, okay, how so? Well, even if no cars drive through, you still have to pay to keep the lights on and the ventilation running inside. To really understand the impact, you have to look at the precise unit math. Right, let's get into the numbers.

So, gateway endpoints, the ones you use for S3 and DynamoDB, those are completely free. Okay, so S3 and DynamoDB are fine. Right, but an interface endpoint bills about one cent per hour for each availability zone it is deployed in, and that is whether or not any traffic flows. Wait, one cent an hour per AZ just for existing? Yes, exactly.

Plus about one cent per gigabyte processed in US East-1. So the meter is just always running? It is. Just one endpoint sitting in three availability zones. It's about $22 a month.

$22 a month, which doesn't sound like a massive deal until you realize an organization might have dozens or, you know, hundreds of these forgotten tunnels. Oh, easily. And the reason this waste accumulates silently is because nobody really owns it. It triggers zero alarms. Yeah, and if AWS just buries this in the main per-service bill, you can't just wait for finance to yell at you.

So how do we actually find this footprint? Since it is network infrastructure, product teams rarely audit it. An endpoint gets deployed for a proof of concept or an old architectural pattern, and then it is simply forgotten. Right, out of sight, out of mind. Exactly.

To detect it yourself, you have to look directly at the telemetry. Check the Amazon VPC or the CloudWatch console. Okay, what metric are we looking for specifically? You are looking for the BytesProcessed metric, and that is under the AWS PrivateLink endpoints namespace. Bytes processed, got it.

Right. If that metric sits at zero over about 14 days, you have found the pattern. See, my instinct as an engineer is to see zero bytes for two weeks and just instantly hit the delete button, like save the $22. I would not do that. But knowing AWS, I feel like I am walking into a trap.

You absolutely are. I have to warn you right now, you can never call a resource provably or guaranteed unused. Wait, really? Even if the metric is flat zero? Even then.

There is no check or preview that makes deleting an interface endpoint risk-free. But if no bytes are processing, it's basically dead, right? What is the actual trap here? The trap is how AWS private DNS resolution works. When you enable private DNS on an interface endpoint, it essentially hijacks the default public route for that service inside your VPC.

Oh, I see. It creates a local private route. Exactly. It is kind of like replacing the official public phone book with a private internal directory. If I delete the endpoint, that private directory entry just disappears.

Spot on. Without that private directory, you fundamentally change how that AWS service resolves. So applications sitting in your private subnets might still be looking for that private local route? Yes. And if it is gone, their traffic gets dropped into a black hole.

They lose access to the service entirely. Even if they haven't called it in the last two weeks? Yes. Because the system might still depend on it for an infrequent event. Think about an automated rollback or a disaster recovery scale out.

Oh, wow. So a disaster recovery process could just fail silently because you deleted what looked like an idle endpoint. Exactly. You must check what is calling that service first before making any changes. Never just delete it based on a 14-day metric.

Right. So because you can't blindly delete these without risking a DNS black hole, hunting for this waste manually is a bit of a minefield. It really is. You have to be incredibly careful. Well, if you want a practical way to spot this exact pattern safely, there is a free source available scanner you can use.

You just run pip install cloudcostwise. Yeah. That runs read-only on your own machine. Exactly. It flags this pattern and sends nothing to CloudWise, so you can see what's happening without taking any risks.

It gives you the visibility you need to start asking the right questions about your network dependencies before you accidentally break a route. It maps out those empty private tunnels for you. Which leaves you with this to think about. Beyond endpoints, what other invisible infrastructure is quietly billing by the hour in your own private subnets right now?