The vpc interface endpoints required to make AWS Batch work in private subnets without internet access (nat gateways).

endpoints.ts

// Without nat gateways, we need to create an interface endpoint
// for each service we need to access in a private subnet.
// Each vpc endpoint costs ~$0.01 per hour ($7.60/month), so we should
// try to minimise the number of endpoints we create.
this.addInterfaceEndpoints(this.vpc, [
  [ec2.InterfaceVpcEndpointAwsService.BATCH, true],
  [ec2.InterfaceVpcEndpointAwsService.CLOUDWATCH_LOGS, true],
  [ec2.InterfaceVpcEndpointAwsService.EC2, true],
  [ec2.InterfaceVpcEndpointAwsService.EC2_MESSAGES, true],
  [ec2.InterfaceVpcEndpointAwsService.ECR, true],
  [ec2.InterfaceVpcEndpointAwsService.ECR_DOCKER, true],
  [ec2.InterfaceVpcEndpointAwsService.ECS, true],
  [ec2.InterfaceVpcEndpointAwsService.ECS_AGENT, true],
])

// The S3 gateway endpoint is free, unlike the vpc endpoints above.
this.vpc.addGatewayEndpoint('S3GatewayEndpoint', {
  service: ec2.GatewayVpcEndpointAwsService.S3,
})


addInterfaceEndpoints(
  vpc: ec2.Vpc,
  endpoints: [ec2.InterfaceVpcEndpointAwsService, boolean][]
) {
  endpoints.forEach(([service, privateDnsEnabled]) => {
    vpc.addInterfaceEndpoint(`${service.shortName}Endpoint`, {
      service,
      privateDnsEnabled,
      subnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
    })
  })
}