AWS PrivateLink
AWS PrivateLink is a network service of Amazon Web Services used to connect to AWS services hosted by other AWS accounts, referred to as endpoint services, or to the AWS Marketplace. It provides the VPC endpoints described in Amazon VPC Components without exposing traffic to the public internet.
Key points
- Used for scenarios where the source VPC acts as a service provider and the destination VPC acts as a service consumer.
- Service consumers use an interface endpoint to access the services running in the service provider.
- Provides security by keeping traffic off the public internet, reducing exposure to threats such as brute-force and DDoS attacks.
- Types of VPC endpoints:
- Interface Endpoints — serve as an entry point for traffic destined to an AWS service or a VPC endpoint service.
- Gateway Endpoints — a gateway in the route table that routes traffic only to Amazon S3 and Amazon DynamoDB; unlike the other endpoint types, gateway endpoints do not use PrivateLink.
- Gateway Load Balancer endpoints — send traffic to a fleet of virtual appliances (such as firewalls) for inspection.
- Resource endpoints and Service network endpoints — newer endpoint types, backed by Amazon VPC Lattice, that give private access to an individually shared resource or to an entire service network rather than to a single AWS service.
- Distinct from a NAT gateway: VPC endpoints created through PrivateLink give private access only to specific AWS services or endpoint services, not general outbound internet connectivity.