AWS PrivateLink Popular2017年〜
Connect privately from your VPC to AWS services and third-party services without traversing the internet
What It Does
AWS PrivateLink lets resources in your VPC connect privately to AWS services, services in other AWS accounts, and third-party services on AWS Marketplace - all without going through the internet. When you create a VPC endpoint, traffic stays entirely within the AWS private network.
Use Cases
Accessing AWS services in environments where internet-based access is prohibited by security requirements, private connections to SaaS provider services, and private communication between microservices.
Everyday Analogy
Think of a private corridor between buildings. Instead of walking on the public road (internet) to reach the next building (AWS service), you use a private corridor (PrivateLink) to get there safely without any external exposure.
What Is PrivateLink?
AWS PrivateLink enables private connectivity through VPC endpoints. When you create an interface VPC endpoint, an ENI (Elastic Network Interface) is created in your VPC subnet, allowing you to access AWS services via a private IP address. This eliminates the need for a NAT Gateway or internet gateway.
Types of Endpoints
There are two types of VPC endpoints. Interface endpoints (PrivateLink) are ENI-based and support most AWS services other than S3 and DynamoDB. Gateway endpoints are dedicated to S3 and DynamoDB and work by adding routes to your route table. Gateway endpoints are free, while interface endpoints incur hourly and data processing charges. For real-world examples and best practices on endpoint types, technical books on Amazon are a useful reference.
Getting Started
In the VPC console, go to "Endpoints" and select "Create endpoint," then choose the target service. For interface endpoints, specify the subnet and security group. You can also restrict access with an endpoint policy. For S3 and DynamoDB, start with gateway endpoints (free) first.
Things to Watch Out For
- Gateway endpoints (S3, DynamoDB) are free. Interface endpoints incur hourly charges plus data processing fees
- Interface endpoints must be created per AZ. For high availability, create them in multiple AZs
