PrivateLink vs VPC Peering
Service endpoint exposure versus full VPC routing for private connectivity.
Overview
What is being compared
Both give private connectivity between VPCs, at very different scopes. AWS PrivateLink exposes one service endpoint, backed by an NLB, to consumers in other VPCs without allowing VPC routing. VPC Peering or Transit Gateway create full bidirectional routing between VPC CIDR blocks.
- What is exposed — One service, a TCP port on an NLB — The provider's full CIDR block
- Direction — One way, the consumer initiates — Both ways
- Overlapping CIDRs — Works — Not allowed
- DNS — Endpoint DNS names, optional private DNS — Plain IP routing, no DNS integration
- Provider needs — An NLB — Route table entries
- Best for — External customers or untrusted VPCs — First-party VPCs needing broad connectivity
Service endpoint versus full routing
A PrivateLink consumer reaches one service through an endpoint in its own VPC. A peering connection lets any resource in either VPC reach any resource in the other.
The endpoint connection lifecycle
With acceptance required, a consumer's new endpoint waits for the provider to accept it before any traffic flows.
> [!WARNING] By default any AWS account can request a PrivateLink connection; turn on acceptance required and allow specific account IDs.
> [!TIP] What each option exposes, one request through each, and the choice between them play step by step in Visual Explanation below.
Sign up free to read the full topic
More Comparisons topics
Start free on Cariara · Coding problems · System design studio