VPC interface endpoints bill an hourly availability charge per Availability Zone where they are deployed, even when traffic is near zero. This finding is distinct from NAT Gateway overuse: NAT findings flag high data-processing charges on a shared egress path, while idle endpoint findings flag private connectivity you are paying for but not using.
Before you delete an endpoint
- Confirm no applications, Lambda functions, or batch jobs still route traffic through this endpoint (check security groups, route tables, and DNS resolution in the VPC).
- Verify the same AWS service is not reachable through a different endpoint, a gateway endpoint, or public internet paths your workloads still depend on.
- Review cross-AZ endpoint deployments — deleting one AZ's endpoint may be enough if traffic is concentrated elsewhere.
- Coordinate with teams that onboarded the endpoint for compliance or private-link requirements; some endpoints exist for audit reasons despite low traffic.
Paid plans include remediation scripts to delete the endpoint. Review the generated commands against your network diagram before running them in production.
What triggers this finding
A VPC interface endpoint with near-zero traffic over the lookback window, still incurring hourly availability charges.
Typical fix
Delete the endpoint if workloads no longer need private connectivity to the service. Update route tables and security groups first.
Example savings
About $7–$15/month per interface endpoint in most regions, plus data processing charges.
See also: Severity and savings estimates for how Parsivex calculates figures on your report.