CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Amazon VPC Endpoints & PrivateLink — Securely connect services without traversing the internet
Amazon VPC Endpoints enable private connections between your VPC and supported AWS services, without requiring internet access.
What it is
- Amazon VPC Endpoints allow private connectivity to AWS services and VPC endpoint services powered by PrivateLink.
- There are two types: Interface Endpoints (for AWS services) and Gateway Endpoints (for S3 and DynamoDB).
When I reach for it
- When you need to connect to AWS services securely from within your VPC without using public IPs.
- When you want to enhance security by avoiding exposure to the internet.
- When integrating with third-party services via PrivateLink.
Key architectural decisions
- Choose between Interface and Gateway endpoints based on the service you are connecting to.
- Consider endpoint policies for fine-grained access control.
- Assess the impact on costs; Interface Endpoints incur hourly charges and data processing fees.
Gotchas & exam traps
- Remember that Gateway Endpoints only support S3 and DynamoDB — other services require Interface Endpoints.
- Be aware of the limits on the number of endpoints per VPC and region.
- Endpoint policies are not IAM policies; they control access to the endpoint itself, not the underlying service.
The architect view
- Leverage VPC Endpoints to enhance security and reduce latency by keeping traffic within the AWS network.
- Use PrivateLink for seamless integration with partner services while maintaining network isolation.