Private Connectivity with AWS PrivateLink - VPC Endpoints and Endpoint Services
Connect to AWS services privately without traversing the internet. Learn about free Gateway Endpoints and building Endpoint Services.
Overview of PrivateLink
PrivateLink is a service that provides private connectivity from a VPC to AWS services and SaaS applications. Traffic stays within the AWS private network without traversing an internet gateway or NAT Gateway. This enables the use of AWS services even in environments where internet access is prohibited for security requirements.
Types of Endpoints
Interface Endpoints create an ENI (Elastic Network Interface) in a subnet, providing access to AWS services via a private IP address. They incur hourly and data processing charges. Gateway Endpoints are exclusive to S3 and DynamoDB, working by adding a prefix list to the route table. They are free to use, and Gateway Endpoints are recommended for heavy S3 access. Endpoint Policies can restrict access to specific S3 buckets, preventing unintended data exfiltration.
Building Endpoint Services
To expose your own service to other accounts via PrivateLink, place the service behind an NLB or GWLB and create an Endpoint Service. Allowed principals control which accounts or IAM principals can connect, and you can configure manual or automatic approval of connection requests. On the consumer side, an Interface Endpoint is created to access the service via a private DNS name. When a private DNS name is configured, DNS resolution within the consumer's VPC points to the endpoint's ENI, enabling a switch to private connectivity without application code changes. Endpoint Policies restrict access to specific API actions or resources, preventing data exfiltration. For more on VPC Endpoints, see related books on Amazon.
PrivateLink Pricing and Design Guidelines
Interface Endpoints incur hourly charges (approximately $0.01/hour) and data processing charges (approximately $0.01/GB) per AZ. Multi-AZ configurations multiply costs by the number of AZs, so determine the number of AZs based on availability requirements. Gateway Endpoints (S3, DynamoDB) are free and represent the most effective cost optimization for reducing traffic through NAT Gateway. For high data transfer volumes, compare PrivateLink data processing charges with NAT Gateway data processing charges to choose the more cost-efficient option. VPC Endpoint usage can be monitored with CloudWatch metrics, and unused endpoints can be identified and deleted to reduce costs.
Summary
PrivateLink provides private connectivity from VPCs, enabling secure communication without traversing the internet. Gateway Endpoints establish free private connectivity to S3/DynamoDB, while Interface Endpoints provide private access to over 100 AWS services. Endpoint Policies restrict access, and Endpoint Services securely expose your own services to other accounts.