AWS PrivateLink
- Type
- Popular
- Launched
- 2017
Connect privately from your VPC to AWS services and third-party services without traversing the internet
What It Does
AWS PrivateLink lets resources in your VPC connect privately to AWS services, services in other AWS accounts, and third-party services on AWS Marketplace - all without going through the internet. When you create a VPC endpoint, traffic stays entirely within the AWS private network.
Use Cases
Accessing AWS services in environments where internet-based access is prohibited by security requirements, private connections to SaaS provider services, and private communication between microservices.
Everyday Analogy
Think of a private corridor between buildings. Instead of walking on the public road (internet) to reach the next building (AWS service), you use a private corridor (PrivateLink) to get there safely without any external exposure.
What Is PrivateLink?
AWS PrivateLink enables private connectivity through VPC endpoints. When you create an interface VPC endpoint, an ENI (Elastic Network Interface) is created in your VPC subnet, allowing you to access AWS services via a private IP address. This eliminates the need for a NAT Gateway or internet gateway.
Types of Endpoints
There are two types of VPC endpoints. Interface endpoints (PrivateLink) are ENI-based and support most AWS services other than S3 and DynamoDB. Gateway endpoints are dedicated to S3 and DynamoDB and work by adding routes to your route table. Gateway endpoints are free, while interface endpoints incur hourly and data processing charges.
Getting Started
In the VPC console, go to "Endpoints" and select "Create endpoint," then choose the target service. For interface endpoints, specify the subnet and security group. You can also restrict access with an endpoint policy. For S3 and DynamoDB, start with gateway endpoints (free) first.
Things to Watch Out For
- Gateway endpoints (S3, DynamoDB) are free. Interface endpoints incur hourly charges plus data processing fees
- Interface endpoints must be created per AZ. For high availability, create them in multiple AZs
Available Regions
AWS PrivateLink is available in 37 Regions (as of 2026-10-09).
Asia Pacific: Hong Kong, Taipei, Tokyo, Seoul, Osaka, Mumbai, Hyderabad, Singapore, Sydney, Jakarta, Melbourne, Malaysia, New Zealand, Thailand
North America: Canada (Central), Canada West (Calgary), Mexico (Central), US East (N. Virginia), US East (Ohio), US West (N. California), US West (Oregon)
South America: São Paulo
Europe: Frankfurt, Zurich, Stockholm, Milan, Spain, Ireland, London, Paris
AWS European Sovereign Cloud: Germany
Middle East: Israel (Tel Aviv), UAE, Bahrain
Africa: Cape Town
AWS GovCloud (US): AWS GovCloud (US-East), AWS GovCloud (US-West)
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
If this page and the official documentation disagree, treat the official documentation as authoritative.
