Interface endpoint (AWS PrivateLink) — an elastic network interface with a private IP in your subnet. Works for most other AWS services and your own services. Charged per hour + per GB.
Why it matters
Private subnets reach AWS services without a NAT Gateway — cheaper and more secure.
Keeps sensitive traffic (e.g. to S3) off the internet, satisfying compliance requirements.
Not to be confused with
NAT Gateway — general outbound internet access. Endpoints are private access to specific AWS services only.