Acronyms
- VPC - Virtual Private Cloud
VPC Endpoint Services (AWS Private Link)
You can create your own application in your VPC and configure it as an AWS PrivateLink-powered service (referred to as an endpoint service). Other AWS principals can create a connection from their VPC to your endpoint service using an interface VPC Endpoint. You are the service provider, and the AWS principals that create connections to your service are service consumers.
Use a VPC endpoint to access AWS resources if you only require access to those resources from within a virtual private cloud (VPC). Doing this prevents that traffic from traversing the open internet
In the following diagram, the account owner of VPC B is a service provider, and has a service running on instances in subnet B. The owner of VPC B has a service endpoint (vpce-svc-1234) with an associated Network Load Balancer that points to the instances in subnet B as targets. Instances in subnet A of VPC A use an interface endpoint to access the services in subnet B.
Illustration of VPC Endpoint Service
Illustration of VPC Endpoint Service. Source: docs.aws.amazon.com
For low latency and fault tolerance, we recommend using a Network Load Balancer with targets in every Availability Zone of the AWS Region. To help achieve high availability for service consumers that use zonal DNS hostnames to access the service, you can enable cross-zone load balancing. Cross-zone load balancing enables the load balancer to distribute traffic across the registered targets in all enabled Availability Zones. For more information, see Cross-Zone Load Balancing
In the following diagram, the owner of VPC B is the service provider, and it has configured a Network Load Balancer with targets in two different Availability Zones. The service consumer (VPC A) has created interface endpoints in the same two Availability Zones in their VPC. Requests to the service from instances in VPC A can use either interface endpoint.
Illustration of VPC Endpoint Service - Multi AZ
Illustration of VPC Endpoint Service - Multi AZ. Source: docs.aws.amazon.com
Considerations
-
Note that there is a charge for data transfer between Regions.
-
Note The AZ
us-east-1afor your AWS account might not be the same
location as us-east-1a for another AWS account. This is because, AWS ensures
that resources are distributed across the AZs by independently mapping AZs to
names for each AWS account.
- To coordinate AZs across accounts, you must use the AZ ID, which is a unique
and consistent identifier for an Availability Zone. For example, use1-az1 is
an AZ ID for the us-east-1 Region and it has the same location in every AWS
account.
Security
Using a VPC endpoint for AWS resources, allows you to control and limit access using the following:
-
VPC endpoint policies – These policies are applied on the VPC endpoint. They allow you to control and limit API access to the AWS resource.
-
IAM policies – By using the
aws:sourceVpcecondition on policies attached to IAM users, groups, or roles, you can enforce that all access to specified AWS Resources is via the specified VPC endpoint.