AWS PrivateLink

Interface VPC endpoints, NLB-backed endpoint services, private connectivity without internet traversal, and endpoint service sharing.

Overview

Overview AWS PrivateLink provides private connectivity between VPCs, AWS services, and on-premises applications without exposing traffic to the public internet. It enables service providers (whether AWS itself or third-party SaaS vendors) to offer services that consumers can access privately from within their own VPCs.

PrivateLink works through two complementary constructs: VPC Endpoints (on the consumer side) and Endpoint Services (on the provider side). An Interface VPC Endpoint creates one or more Elastic Network Interfaces (ENIs) with private IP addresses in your VPC subnets. Traffic to the service is routed through these ENIs, never leaving the AWS network. This is fundamentally different from internet-based access or even VPC peering — the service's actual infrastructure can be in a completely separate VPC or account.

The provider side uses a Network Load Balancer (NLB) as the front door to an Endpoint Service. The NLB receives traffic from consumers' ENIs and forwards to the actual service targets (EC2 instances, ECS tasks, Lambda functions via ALB). AWS manages the cross-VPC networking transparently.

AWS uses PrivateLink for its own services: S3 Interface Endpoints, DynamoDB Interface Endpoints, SSM, Secrets Manager, ECR, and dozens more all support private connectivity via PrivateLink. This allows EC2 instances in private subnets with no internet gateway to still access AWS APIs securely.

Third-party SaaS vendors (Datadog, Snowflake, New Relic) offer their services via PrivateLink, allowing enterprise customers to consume SaaS without traffic leaving their private network perimeter — critical for compliance-sensitive industries like healthcare and finance.

Key concepts

Interface VPC Endpoint
A PrivateLink endpoint that creates ENIs with private IPs in your VPC subnets. Traffic to the endpoint service is routed through these ENIs using AWS-internal networking. Supports security groups for access control. DNS entries are created automatically so that the service regional hostname resolves to the private ENI IP.
Gateway Endpoint
An older endpoint type for S3 and DynamoDB only. Unlike Interface Endpoints, Gateway Endpoints work by adding entries to your VPC route table pointing to the endpoint, not by creating ENIs. Gateway Endpoints have no per-hour charge (unlike Interface Endpoints) but do not support private DNS or cross-region access.
Endpoint Service
The provider-side PrivateLink construct. Built on top of an NLB in the provider's VPC. The provider configures which AWS accounts or principals can create endpoints to the service. Once a consumer creates an interface endpoint, the provider can accept or auto-accept the connection request.
Private DNS
When Private DNS is enabled on an Interface Endpoint, AWS creates a private hosted zone in Route 53 that overrides the public DNS hostname for the service within your VPC. For example, s3.us-east-1.amazonaws.com resolves to the ENI private IP instead of the public S3 endpoint. This allows existing code to use PrivateLink without DNS changes.
Endpoint Policies
Resource-based policies attached to VPC endpoints that restrict which actions and resources can be accessed through the endpoint. For example, an S3 endpoint policy can restrict access to specific S3 buckets, preventing use of the private endpoint to access other accounts' buckets.

When to use it

  • Accessing AWS services (S3, SSM, ECR) from private subnets without NAT Gateway
  • Consuming third-party SaaS (Datadog, Snowflake) without internet exposure for compliance
  • Exposing internal microservices to other teams or accounts without VPC peering
  • Reducing data transfer costs for high-volume AWS API calls (PrivateLink vs NAT Gateway pricing)
  • Meeting regulatory requirements that prohibit any internet-traversing traffic for sensitive data

Interview questions

  • How would you design private connectivity for an EC2 instance in a private subnet (no NAT Gateway, no internet gateway) to access S3, SSM Parameter Store, and ECR for container image pulls?

Sign up free to read the full topic

More Networking topics

Start free on Cariara · Coding problems · System design studio