A SaaS platform spends heavily on NAT gateway processing and cross-AZ traffic between microservices and S3, needs private access to AWS services, regional data paths, and minimal inter-AZ charges without losing HA. Which network design optimizes data transfer costs?

Correct design works because gateway endpoints give free private regional access to S3 and DynamoDB via VPC route tables without NAT processing, internet traversal, or transit hops, eliminating the dominant storage transfer costs, while interface endpoints extend private PrivateLink connectivity to other services lacking gateway support, and AZ-aware routing keeps service traffic in the originating AZ to minimize inter-AZ fees while retaining multi-AZ high availability. All-interface design including S3 fails on cost optimization since interface endpoints charge hourly per AZ plus per-GB processing, so replacing a free gateway path with paid PrivateLink adds major recurring expense for no added privacy. Single-AZ consolidated endpoints and NAT fail on high availability because concentrating paid resources in one zone creates a single point of failure and forces other zones into cross-AZ calls, trading small hourly savings for outage risk and higher inter-AZ charges. Multi-AZ endpoints with default round-robin routing fail on locality because without zonal affinity requests often resolve to a different AZ, preserving privacy and regional paths but generating avoidable inter-AZ fees. Exam caveat is to distinguish free route-based gateway endpoints limited to S3 and DynamoDB from paid ENI-based interface endpoints and choose the cheapest private option per service. Practical check is to compare NAT processing and inter-AZ transfer in Cost Explorer before and after and verify with VPC Flow Logs that endpoint traffic stays zonal.