Idle VPC Interface Endpoint
CostLens flags Interface (PrivateLink) VPC endpoints with no traffic — each bills around $7.30/month per Availability Zone whether or not anything uses it.
Interface VPC endpoints (AWS PrivateLink) charge an hourly fee per endpoint, per Availability Zone (~$0.01/hr ≈ $7.30/month each) regardless of usage. An endpoint with no traffic is paying for connectivity nobody needs. Gateway endpoints (S3, DynamoDB) are free and are not flagged.
How it works
CostLens lists interface endpoints
Calls ec2:DescribeVpcEndpoints filtered to the Interface type, skipping endpoints that aren't available (e.g. pending or deleting).
Checks for traffic
Queries CloudWatch (AWS/PrivateLinkEndpoints) for bytes/packets over the past 14 days.
Flags idle endpoints
Flags endpoints with zero traffic. Estimated savings is ~$7.30 × the number of subnets/AZs the endpoint spans.
What to do
- Open the recommendation to see the endpoint, its service name, and AZ count.
- Confirm nothing depends on the endpoint (check security groups, private DNS, and application config).
- Delete the endpoint in the AWS console once verified. This check is advisory — deletion is customer-initiated to avoid breaking private connectivity.
No-data is treated as idle
If CloudWatch has no traffic metrics for the endpoint at all, CostLens treats it as idle — a brand-new endpoint may briefly appear here until it carries traffic.
Severity levels
| Severity | Estimated monthly savings |
|---|---|
| critical | >$500 |
| high | $100–$500 |
| medium | $20–$100 |
| low | <$20 |
Required IAM permissions
Read-only — covered by the CostLens ReadOnlyAccess policy from AWS Accounts:
ec2:DescribeVpcEndpoints
cloudwatch:GetMetricStatistics
Limitations
- Advisory only — CostLens does not delete VPC endpoints automatically.
- Gateway endpoints (S3/DynamoDB) are free and intentionally excluded.