Solutions
AWS Transit
Gateway
AWS
AWS RAM
PrivateLink
© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
Solutions
AWS Transit
Gateway
AWS
AWS RAM
PrivateLink
© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
PrivateLink solutions
What options are there other than VPC
peering? We have an internal SaaS
application that we need to share with
multiple applications across multiple VPCs.
Security auditor
© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
VPC endpoint solutions
With VPC endpoints
VPC
Public subnet
• VPC-based
resources can
access AWS Internet
service endpoints Internet
while staying on gateway
the AWS network Private subnet
• No need for
internet access AWS service endpoint
– or –
Shared service
EC2 instance VPC endpoint
© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
VPC endpoint components
Interface endpoint Gateway endpoint
• PrivateLink is a
type of interface
endpoint
• AWS PrivateLink is
also known as VPC
endpoint services
AWS PrivateLink
© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
PrivateLink components
• The endpoint is
assigned a DNS
name
• The endpoint
sends a request to
a Network Load 53
Balancer, which
then routes to
your service
• Control access to
EC2 instance Route 53 DNS PrivateLink Shared service
the endpoint using
endpoint policies
• Not every AWS
service supports
this feature
© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
PrivateLink and endpoint services features
1
VPC SaaS
1. Share to
thousands of VPCs Subnet Subnet
2. Security group for
the connection
3. Support for
overlapping 2 4 5
addresses
VPC Network
4. One-way access Load
endpoint
5. Share a single Balancer
3
service
© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
PrivateLink setup
Navigate to the AWS Management Console
Choose a subnet in your VPC to use the interface endpoint
AWS creates the endpoint network interface in the subnet
Create the endpoint in the console
Specify the Network Load Balancer that you created
Grant permissions to consumers, such as AWS accounts or IAM roles
A service consumer creates an interface endpoint to your service
Accept the interface endpoint connection request
© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
PrivateLink setup
• Endpoint policies
are IAM resource
policies VPC endpoint policy
• You can attach an
endpoint policy to
Consumer account Service provider account
a PrivateLink
endpoint
• Written in JSON VPC VPC
format
• Define how the
endpoint can be
used PrivateLink
Instance endpoint
© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
PrivateLink notes
Ensure that the security
group selected for the Only IPv4 is supported.
endpoint will allow traffic
through to the service.
By default, each interface
endpoint can support a
Endpoints do not support
bandwidth of up to 10
UDP traffic.
Gbps, bursting to 40 Gbps
per Availability Zone.
© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
