Hacker News Reader

You can provision gateway endpoints for S3 and DynamoDB. They are free and considered best practice. They are opt-in though, but easy to enable.

And, as as added benefit, they distinguish between "just pull" and "pull and push" which is nice

True, I forgot that. But depending on services you still have to have some Gateway and some Interface endpoints.