funnel vpn athena traffic through a VPC endpoint

[thecaffiend]

right now our access to athena goes the default route, which goes through the internet. this was done for speed of getting a POC as well as for cost savings in the short term.

long term, it's almost certainly the case that queries to the datalake would be best to have all traffic kept on the VPC for security. additionally when query volume (and data traffic) increase, the cost of keeping the VPC endpoint up may well be cheaper than the data transit cost incurred in the default manner.