Private Connectivity with AWS PrivateLink - VPC Endpoints and Endpoint Services
Connect to AWS services privately without traversing the internet. Learn about free Gateway Endpoints and building Endpoint Services.
Overview of PrivateLink
PrivateLink is a service that provides private connectivity from a VPC to AWS services and SaaS applications. Traffic stays within the AWS private network without traversing an internet gateway or NAT Gateway. This enables the use of AWS services even in environments where internet access is prohibited for security requirements.
Types of Endpoints
Interface Endpoints create an ENI (Elastic Network Interface) in a subnet, providing access to AWS services via a private IP address. They incur hourly and data processing charges. Gateway Endpoints are exclusive to S3 and DynamoDB, working by adding a prefix list to the route table. They are free to use, and Gateway Endpoints are recommended for heavy S3 access. Endpoint Policies can restrict access to specific S3 buckets, preventing unintended data exfiltration.
Building Endpoint Services
To expose your own service to other accounts via PrivateLink, place the service behind an NLB or GWLB and create an Endpoint Service. Allowed principals control which accounts or IAM principals can connect, and you can configure manual or automatic approval of connection requests. On the consumer side, an Interface Endpoint is created to access the service via a private DNS name. When a private DNS name is configured, DNS resolution within the consumer's VPC points to the endpoint's ENI, enabling a switch to private connectivity without application code changes. Endpoint Policies restrict access to specific API actions or resources, preventing data exfiltration.
PrivateLink Pricing and Design Guidelines
Interface Endpoints incur hourly charges (approximately USD 0.01/hour) and data processing charges (approximately USD 0.01/GB) per AZ (as of August 2026). Multi-AZ configurations multiply costs by the number of AZs, so determine the number of AZs based on availability requirements. Gateway Endpoints (S3, DynamoDB) are free and represent the most effective cost optimization for reducing traffic through NAT Gateway. For high data transfer volumes, compare PrivateLink data processing charges with NAT Gateway data processing charges to choose the more cost-efficient option. VPC Endpoint usage can be monitored with CloudWatch metrics, and unused endpoints can be identified and deleted to reduce costs.
DNS and Private Name Resolution
What increases convenience when using PrivateLink is the private DNS feature. When you enable private DNS on an Interface Endpoint, the service's original hostname comes to be resolved to the endpoint's address within the VPC. This lets you switch only the communication to a private path without changing application code or settings. For resolution from on-premises, combine it with Route 53 Resolver. If the name resolution path is not designed correctly, there are cases where a public path is used unintentionally, so DNS configuration is an important element of PrivateLink design.
Security and Boundary Design
The advantage of PrivateLink is that communication can be completed within the VPC without going out to the internet. This lets you connect safely to the services you need even from a closed network that has no internet gateway. You can set policies on endpoints to restrict which operations are allowed on which resources. Use security groups to narrow down the sources of communication and open only the minimum necessary paths. Even in configurations where services are provided and used across accounts, going through PrivateLink lets you safely expose only specific services without showing the entire network to the other party.
Common Use Cases
PrivateLink meets a variety of connectivity requirements. SaaS providers can use it as a path to safely provide their own services to customers' VPCs. A configuration is also possible in which on-premises environments and AWS are connected via a dedicated line or VPN, and only specific services are then reached via PrivateLink. It is also suitable for letting multiple accounts and teams safely use shared services within an organization. Because it connects services without going through the internet, it delivers particular value in environments with requirements such as wanting to keep data paths within the company or not wanting to add public endpoints.
Operations and Availability
To use PrivateLink in production, design for both availability and cost. Place endpoints in multiple Availability Zones so that communication can continue even if a failure occurs in a zone. Because Interface Endpoints are charged according to time and the volume of data processed, create them only for the services you really need and do not leave unnecessary endpoints in place. Connections to some services can be replaced with free Gateway Endpoints, so using the types appropriately keeps costs down. Monitoring usage and regularly reviewing the number and configuration of endpoints leads to efficient operations.
Summary
PrivateLink is a service that provides private connectivity from VPCs and achieves secure communication that does not traverse the internet. Gateway Endpoints establish free private connectivity to S3/DynamoDB, and Interface Endpoints provide private access to 100 or more AWS services. Endpoint Policies restrict access, and Endpoint Services securely expose your own services to other accounts.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- AWS PrivateLink official page
- Amazon VPC official page
- Amazon S3 official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.