Private Connectivity solves the problem of accessing AWS services without sending data over the public internet. It matters for the ANS-C01 exam because designing secure, high-performance, and compliant network architectures often requires keeping traffic within the AWS network, which is exactly what VPC Endpoints and AWS PrivateLink enable you to do.
Jump to a section
A simple way to picture Private Connectivity: VPC Endpoints and PrivateLink
Because your office building has a public postal address, anyone can send you packages, but that also means strangers can wander into the lobby. This leads to security concerns and unwanted deliveries.
To solve this, you set up a private mailroom in the basement. This mailroom is exclusively for packages from a specific supplier you trust, like your office furniture vendor. The supplier delivers to this private mailroom, not the main lobby. Your internal mail staff then bring the package directly to your desk, never passing through the public area.
This private mailroom is your 'VPC Endpoint'. The dedicated delivery agreement you set up with the furniture vendor is your 'PrivateLink'. Before, you had to open your building's main door (the internet) just to get a desk. Now, the delivery happens entirely within your building's controlled interior. No public streets, no lobby chaos. The package arrives inside your office, securely and privately, without ever touching the public internet. The vendor's delivery truck (the AWS service) backs into your loading dock (the VPC Endpoint), hands off the package through a sealed hatch (PrivateLink), and leaves. The package never touches the public road.
AWS Private Connectivity is the practice of connecting your Virtual Private Cloud (VPC) to other AWS services or other VPCs without using the public internet. A VPC (Virtual Private Cloud) is your own private, isolated section of the AWS cloud where you launch your resources, like virtual servers called EC2 instances. Normally, if a server in your VPC wants to use a service like Amazon S3 (Simple Storage Service, which stores files) or DynamoDB (a database), it has to send traffic out through an Internet Gateway (a door to the public internet) and then back into the AWS service. This is like sending a package out of your house, across town, and then back to your neighbour's house next door. It is inefficient and insecure.
VPC Endpoints solve this. A VPC Endpoint is a virtual device that sits in your VPC and acts as a private entrance to an AWS service. It allows traffic to reach the service without ever leaving the AWS network. There are two main types: Gateway Endpoints and Interface Endpoints. - Gateway Endpoints are used specifically for Amazon S3 and DynamoDB. They work by adding a 'target' to your VPC's route table (the map that tells traffic where to go). When your server tries to reach S3, the route table directs it through the Gateway Endpoint instead of the internet. It is simple and free of charge. - Interface Endpoints are used for many other AWS services like Amazon API Gateway, Amazon CloudWatch, or AWS Systems Manager. They work by creating an Elastic Network Interface (ENI) inside your VPC — think of it like a virtual network card with a private IP address. Your server sends traffic to this private IP, and the Interface Endpoint privately connects to the AWS service. Interface Endpoints are powered by AWS PrivateLink.
AWS PrivateLink is the underlying technology that makes Interface Endpoints work. It securely connects your VPC to an AWS service or to another customer's VPC (or even a third-party service) as if it were directly in your own network. It does this using Network Load Balancers (NLBs) and ENIs. The service provider (for example, AWS for Amazon API Gateway) creates a service endpoint using an NLB, and you, the consumer, create an Interface Endpoint in your VPC that connects to that NLB privately.
Why does this replace the old way? Before VPC Endpoints, if you wanted to keep S3 traffic private (e.g., for compliance reasons), you had to set up a complex proxy server or a VPN (Virtual Private Network). That was expensive and slow. VPC Endpoints replace that with a simple, native, and high-bandwidth solution. You also get better security because you can attach an Endpoint Policy, which is a permission document that controls which resources (like specific S3 buckets) the endpoint can access. This prevents data exfiltration.
In the exam, you will need to understand the difference between Gateway and Interface Endpoints, know which AWS services use which type, and grasp how PrivateLink enables you to connect to marketplaces and partner services securely.
Identify the AWS Service
Determine which AWS service you need to connect to privately. Is it S3 or DynamoDB? Or is it a different service like SQS, Lambda, or CloudWatch? This choice dictates whether you use a Gateway Endpoint or an Interface Endpoint.
Choose the Endpoint Type
If the service is S3 or DynamoDB, you select Gateway Endpoint. For all other supported services, you select Interface Endpoint. This is the critical branching point that determines cost, security, and configuration method.
Create the VPC Endpoint
Using the VPC Console, you create the endpoint. For Gateway Endpoints, you select the VPC and the route tables to associate. For Interface Endpoints, you select the VPC, subnets (where the ENI will be created), and optionally a security group. This step provisions the virtual network component.
Configure Routes or DNS
For Gateway Endpoints, AWS automatically adds a route to your selected route tables directing traffic for the service to the endpoint. For Interface Endpoints, you enable Private DNS so that the service's public DNS name resolves to the endpoint's private IP. Without this, traffic might still go over the internet.
Attach an Endpoint Policy
Optionally, you attach a JSON policy document to the endpoint to restrict which resources (e.g., specific S3 buckets) or actions (e.g., only GetObject) can be performed through the endpoint. This provides granular security and is critical for compliance.
Test and Verify Connectivity
From a resource inside your VPC (like an EC2 instance), test accessing the AWS service using its standard DNS name. Verify that the connection succeeds and that traffic is not leaving the VPC to the internet. You can use tools like traceroute or VPC Flow Logs to confirm.
An IT professional designing a secure data analytics platform for a financial services company needs to move large amounts of data from EC2 instances to Amazon S3 for storage, and then use Amazon Athena to query that data. The company has strict compliance requirements: no data can traverse the public internet.
Step one: The professional creates a VPC with private subnets (subnets that have no direct route to the internet). They launch EC2 instances in these subnets to run the data processing application.
Step two: To allow the EC2 instances to put data into S3, the professional creates a Gateway Endpoint for S3 in the VPC. They add a route in their VPC route table pointing S3 traffic (destined for the S3 service CIDR block) to the Gateway Endpoint. Now, when the application writes data to S3, the traffic uses the endpoint, staying inside AWS.
Step three: To query the data using Amazon Athena, which requires an Interface Endpoint, the professional creates a VPC Endpoint of type 'Interface' for the Athena service. This creates an ENI with a private IP address in their subnet.
Step four: The professional then needs to access a third-party security scanning tool hosted in another AWS account. They use AWS PrivateLink. The third-party provider has published their service on the AWS PrivateLink marketplace. The professional accepts the service invitation and creates an Interface Endpoint in their VPC to connect to it. The traffic flows privately between the two VPCs, never touching the internet.
Step five: To ensure maximum security, the professional attaches a VPC Endpoint Policy to the S3 Gateway Endpoint that only allows access to their specific S3 bucket. They also enable DNS resolution for the Interface Endpoints so that the standard AWS DNS names for Athena resolve to the private IP addresses of the ENIs.
The daily tasks for this professional include:
Checking CloudWatch Logs for endpoint connection errors.
Updating endpoint policies as new buckets or users are added.
Troubleshooting DNS resolution issues when an application cannot connect to a service.
Auditing VPC Flow Logs to verify that traffic is indeed flowing through the endpoints and not out to the internet.
Managing the lifecycle of Interface Endpoints, which have an hourly cost, to avoid unnecessary charges when they are not needed.
The ANS-C01 exam tests Private Connectivity heavily. You should expect multiple questions on VPC Endpoints and PrivateLink, often scenario-based. The exam rewards precise knowledge of the differences between endpoint types and the specific AWS services supported.
Key exam topics to memorise:
Gateway Endpoints: Only for S3 and DynamoDB. Free. Use route tables. Do not use PrivateLink. No security groups (only endpoint policies).
Interface Endpoints: For all other AWS services (and Marketplace services). Cost per hour + per GB of data processed. Powered by PrivateLink. Use security groups. Use DNS entries via Route 53.
PrivateLink: The technology. Allows you to expose your own service in your VPC to other VPCs (as a service provider) or consume services (as a service consumer). Uses Network Load Balancers (NLBs) on the provider side and ENIs on the consumer side.
Endpoint Policies: IAM-like JSON documents that control what actions can be performed via the endpoint. Crucial for S3 Gateway Endpoints to prevent access to other buckets.
VPC Endpoint Services (AWS PrivateLink): How you make your own application available to other AWS accounts. Requires a Network Load Balancer.
Traps the exam sets:
Confusing Gateway and Interface Endpoints: They will ask 'Which endpoint type should you use for Amazon SQS?' The answer is Interface, not Gateway (since SQS is not S3 or DynamoDB).
Forgetting that PrivateLink is not the same as a VPC Endpoint: A VPC Endpoint is the thing you create. PrivateLink is the technology behind Interface Endpoints.
Mixing up security controls: Gateway Endpoints do not have security groups. Interface Endpoints do. The exam will test this.
Assuming all services support PrivateLink: Not all do. Only services that have been configured as endpoint services. The exam will list two services and ask which one can be accessed via a VPC Endpoint.
Ignoring DNS: The exam loves to ask how DNS resolution works with Interface Endpoints. You must enable 'Private DNS' for the endpoint to resolve the service's public DNS name to the private IP of the ENI.
Correct answer pattern: When the question says 'keep traffic off the public internet', think VPC Endpoint. If it mentions a specific service, check the list (S3/DynamoDB = Gateway; everything else = Interface). If it mentions a third-party service or connecting your service to another account, think PrivateLink + NLB.
Gateway Endpoints are free and only work for Amazon S3 and DynamoDB, using route tables to direct traffic.
Interface Endpoints are powered by AWS PrivateLink and are used for all other supported AWS services, costing an hourly and per-GB fee.
PrivateLink is the underlying technology that creates a private, one-way connection to a specific service using Network Load Balancers and Elastic Network Interfaces.
To keep traffic completely off the public internet, you must use a VPC Endpoint; a VPN is not sufficient if the traffic goes through the internet gateway.
Endpoint Policies are IAM-based permission documents that allow you to restrict what resources or actions can be accessed via the endpoint, preventing data exfiltration.
For Interface Endpoints, you must enable Private DNS for the standard AWS service DNS names to resolve to the endpoint's private IP address.
Both Gateway and Interface Endpoints can be configured with endpoint policies, but only Interface Endpoints can be associated with security groups.
When you create a PrivateLink service, you must configure a Network Load Balancer to serve as the front-end for your application.
These come up on the exam all the time. Here's how to tell them apart.
Gateway Endpoint
Only for S3 and DynamoDB
Free of charge
Uses route tables, no security groups
Interface Endpoint
For all other supported AWS services
Charged per hour and per GB
Uses security groups and DNS resolution
VPC Peering
Connects two entire VPCs
Requires non-overlapping CIDR blocks
Allows full bidirectional IP-level connectivity
AWS PrivateLink
Connects one VPC to a specific service in another
No CIDR overlap concerns
Provides one-way, service-level access only
Internet Gateway
Opens your VPC to the public internet
Traffic leaves AWS network
Required for resources that need public access
VPC Endpoint
Keeps traffic within AWS network
No public internet exposure
Used for private access to AWS services
Mistake
VPC Endpoints allow your VPC to communicate with any AWS service over the internet.
Correct
VPC Endpoints specifically keep traffic within the AWS network, bypassing the public internet entirely.
The word 'endpoint' sounds like a connection point, leading beginners to assume it uses the public internet, when its entire purpose is the opposite.
Mistake
Gateway Endpoints are more secure than Interface Endpoints.
Correct
Both are secure, but they use different security models. Gateway Endpoints use route tables and endpoint policies. Interface Endpoints use security groups and endpoint policies. Neither is inherently 'more secure'.
Beginners often assume that 'free' means less capable or less secure, leading them to a false comparison.
Mistake
You can use a Gateway Endpoint for a service like Amazon SQS or Amazon API Gateway.
Correct
Gateway Endpoints only support Amazon S3 and DynamoDB. All other services require Interface Endpoints via PrivateLink.
The memory trick 'S3 and DynamoDB' is so specific that beginners forget that it is a complete list and assume other services might also work with Gateway Endpoints.
Mistake
PrivateLink and VPC Peering are the same thing.
Correct
VPC Peering connects two VPCs directly and allows full IP-level connectivity between them. PrivateLink allows you to connect to a specific service in another VPC without full network exposure.
Both provide private connectivity between VPCs, causing confusion. The difference is granularity: peering is a network-wide bridge; PrivateLink is a one-way, service-specific connection.
Mistake
Creating a VPC Endpoint automatically secures all traffic from your VPC to the service.
Correct
You must also configure route tables (for Gateway Endpoints) or DNS resolution and security groups (for Interface Endpoints), and optionally endpoint policies, to actually control and secure the traffic.
Beginners think that simply creating the endpoint is a 'set and forget' security solution, when it is just the infrastructure — the policies and routes are the real security.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A Gateway Endpoint works by adding a route to your route table and only works with Amazon S3 and DynamoDB, and it is free. An Interface Endpoint creates an Elastic Network Interface with a private IP in your subnet, works with many other services, costs money, and uses PrivateLink.
No, you can access AWS services from your VPC over the public internet via an Internet Gateway. A VPC Endpoint is only needed when you want to keep the traffic within the AWS network and avoid the public internet for security, compliance, or performance reasons.
Yes, you can. If the other account has configured their service as a PrivateLink endpoint service and granted your account permissions, you can create an Interface Endpoint in your VPC to connect to it privately.
You must first create a Network Load Balancer (NLB) in front of your application in your VPC. Then, create a VPC Endpoint Service configuration pointing to that NLB. Other accounts can then create Interface Endpoints in their VPCs to connect to your service via your NLB.
You most likely need to enable the 'Private DNS name' option when creating the Interface Endpoint. This ensures that the standard AWS DNS names for the service resolve to the endpoint's private IP address instead of the public IP.
Yes, you can attach a VPC Endpoint Policy to the Gateway Endpoint. This is an IAM-like JSON document that defines which resources (buckets) and actions (like GetObject) are allowed, preventing access to other buckets in the same or different accounts.
You've finished Private Connectivity: VPC Endpoints and PrivateLink. Continue through the ANS-C01 study guide to build a complete picture of the exam.
Done with this chapter?