# Private Connectivity: VPC Endpoints and PrivateLink

> Chapter 6 of the Courseiva AWS-NETWORKING-SPECIALTY curriculum — https://courseiva.com/learn/aws-networking-specialty/private-connectivity-and-vpc-endpoints

**Official objective:** 3.2 — Design and implement private connectivity using VPC endpoints and AWS PrivateLink.

## Introduction

Private Connectivity solves the problem of accessing AWS services without sending data over the public internet. It matters for the ANS-C01 exam because designing secure, high-performance, and compliant network architectures often requires keeping traffic within the AWS network, which is exactly what VPC Endpoints and AWS PrivateLink enable you to do.

## The Private Mailroom Analogy

Because your office building has a public postal address, anyone can send you packages, but that also means strangers can wander into the lobby. This leads to security concerns and unwanted deliveries.

To solve this, you set up a private mailroom in the basement. This mailroom is exclusively for packages from a specific supplier you trust, like your office furniture vendor. The supplier delivers to this private mailroom, not the main lobby. Your internal mail staff then bring the package directly to your desk, never passing through the public area.

This private mailroom is your 'VPC Endpoint'. The dedicated delivery agreement you set up with the furniture vendor is your 'PrivateLink'. Before, you had to open your building's main door (the internet) just to get a desk. Now, the delivery happens entirely within your building's controlled interior. No public streets, no lobby chaos. The package arrives inside your office, securely and privately, without ever touching the public internet. The vendor's delivery truck (the AWS service) backs into your loading dock (the VPC Endpoint), hands off the package through a sealed hatch (PrivateLink), and leaves. The package never touches the public road.

## Core explanation

AWS Private Connectivity is the practice of connecting your Virtual Private Cloud (VPC) to other AWS services or other VPCs without using the public internet. A VPC (Virtual Private Cloud) is your own private, isolated section of the AWS cloud where you launch your resources, like virtual servers called EC2 instances. Normally, if a server in your VPC wants to use a service like Amazon S3 (Simple Storage Service, which stores files) or DynamoDB (a database), it has to send traffic out through an Internet Gateway (a door to the public internet) and then back into the AWS service. This is like sending a package out of your house, across town, and then back to your neighbour's house next door. It is inefficient and insecure.

VPC Endpoints solve this. A VPC Endpoint is a virtual device that sits in your VPC and acts as a private entrance to an AWS service. It allows traffic to reach the service without ever leaving the AWS network. There are two main types: Gateway Endpoints and Interface Endpoints.

- Gateway Endpoints are used specifically for Amazon S3 and DynamoDB. They work by adding a 'target' to your VPC's route table (the map that tells traffic where to go). When your server tries to reach S3, the route table directs it through the Gateway Endpoint instead of the internet. It is simple and free of charge.
- Interface Endpoints are used for many other AWS services like Amazon API Gateway, Amazon CloudWatch, or AWS Systems Manager. They work by creating an Elastic Network Interface (ENI) inside your VPC — think of it like a virtual network card with a private IP address. Your server sends traffic to this private IP, and the Interface Endpoint privately connects to the AWS service. Interface Endpoints are powered by AWS PrivateLink.

AWS PrivateLink is the underlying technology that makes Interface Endpoints work. It securely connects your VPC to an AWS service or to another customer's VPC (or even a third-party service) as if it were directly in your own network. It does this using Network Load Balancers (NLBs) and ENIs. The service provider (for example, AWS for Amazon API Gateway) creates a service endpoint using an NLB, and you, the consumer, create an Interface Endpoint in your VPC that connects to that NLB privately.

Why does this replace the old way? Before VPC Endpoints, if you wanted to keep S3 traffic private (e.g., for compliance reasons), you had to set up a complex proxy server or a VPN (Virtual Private Network). That was expensive and slow. VPC Endpoints replace that with a simple, native, and high-bandwidth solution. You also get better security because you can attach an Endpoint Policy, which is a permission document that controls which resources (like specific S3 buckets) the endpoint can access. This prevents data exfiltration.

In the exam, you will need to understand the difference between Gateway and Interface Endpoints, know which AWS services use which type, and grasp how PrivateLink enables you to connect to marketplaces and partner services securely.

## Real-world context

An IT professional designing a secure data analytics platform for a financial services company needs to move large amounts of data from EC2 instances to Amazon S3 for storage, and then use Amazon Athena to query that data. The company has strict compliance requirements: no data can traverse the public internet.

Step one: The professional creates a VPC with private subnets (subnets that have no direct route to the internet). They launch EC2 instances in these subnets to run the data processing application.

Step two: To allow the EC2 instances to put data into S3, the professional creates a Gateway Endpoint for S3 in the VPC. They add a route in their VPC route table pointing S3 traffic (destined for the S3 service CIDR block) to the Gateway Endpoint. Now, when the application writes data to S3, the traffic uses the endpoint, staying inside AWS.

Step three: To query the data using Amazon Athena, which requires an Interface Endpoint, the professional creates a VPC Endpoint of type 'Interface' for the Athena service. This creates an ENI with a private IP address in their subnet.

Step four: The professional then needs to access a third-party security scanning tool hosted in another AWS account. They use AWS PrivateLink. The third-party provider has published their service on the AWS PrivateLink marketplace. The professional accepts the service invitation and creates an Interface Endpoint in their VPC to connect to it. The traffic flows privately between the two VPCs, never touching the internet.

Step five: To ensure maximum security, the professional attaches a VPC Endpoint Policy to the S3 Gateway Endpoint that only allows access to their specific S3 bucket. They also enable DNS resolution for the Interface Endpoints so that the standard AWS DNS names for Athena resolve to the private IP addresses of the ENIs.

The daily tasks for this professional include:
- Checking CloudWatch Logs for endpoint connection errors.
- Updating endpoint policies as new buckets or users are added.
- Troubleshooting DNS resolution issues when an application cannot connect to a service.
- Auditing VPC Flow Logs to verify that traffic is indeed flowing through the endpoints and not out to the internet.
- Managing the lifecycle of Interface Endpoints, which have an hourly cost, to avoid unnecessary charges when they are not needed.

## Exam focus

The ANS-C01 exam tests Private Connectivity heavily. You should expect multiple questions on VPC Endpoints and PrivateLink, often scenario-based. The exam rewards precise knowledge of the differences between endpoint types and the specific AWS services supported.

Key exam topics to memorise:
- Gateway Endpoints: Only for S3 and DynamoDB. Free. Use route tables. Do not use PrivateLink. No security groups (only endpoint policies).
- Interface Endpoints: For all other AWS services (and Marketplace services). Cost per hour + per GB of data processed. Powered by PrivateLink. Use security groups. Use DNS entries via Route 53.
- PrivateLink: The technology. Allows you to expose your own service in your VPC to other VPCs (as a service provider) or consume services (as a service consumer). Uses Network Load Balancers (NLBs) on the provider side and ENIs on the consumer side.
- Endpoint Policies: IAM-like JSON documents that control what actions can be performed via the endpoint. Crucial for S3 Gateway Endpoints to prevent access to other buckets.
- VPC Endpoint Services (AWS PrivateLink): How you make your own application available to other AWS accounts. Requires a Network Load Balancer.

Traps the exam sets:
- Confusing Gateway and Interface Endpoints: They will ask 'Which endpoint type should you use for Amazon SQS?' The answer is Interface, not Gateway (since SQS is not S3 or DynamoDB).
- Forgetting that PrivateLink is not the same as a VPC Endpoint: A VPC Endpoint is the thing you create. PrivateLink is the technology behind Interface Endpoints.
- Mixing up security controls: Gateway Endpoints do not have security groups. Interface Endpoints do. The exam will test this.
- Assuming all services support PrivateLink: Not all do. Only services that have been configured as endpoint services. The exam will list two services and ask which one can be accessed via a VPC Endpoint.
- Ignoring DNS: The exam loves to ask how DNS resolution works with Interface Endpoints. You must enable 'Private DNS' for the endpoint to resolve the service's public DNS name to the private IP of the ENI.

Correct answer pattern: When the question says 'keep traffic off the public internet', think VPC Endpoint. If it mentions a specific service, check the list (S3/DynamoDB = Gateway; everything else = Interface). If it mentions a third-party service or connecting your service to another account, think PrivateLink + NLB.

## Step by step

1. **Identify the AWS Service** — Determine which AWS service you need to connect to privately. Is it S3 or DynamoDB? Or is it a different service like SQS, Lambda, or CloudWatch? This choice dictates whether you use a Gateway Endpoint or an Interface Endpoint.
2. **Choose the Endpoint Type** — If the service is S3 or DynamoDB, you select Gateway Endpoint. For all other supported services, you select Interface Endpoint. This is the critical branching point that determines cost, security, and configuration method.
3. **Create the VPC Endpoint** — Using the VPC Console, you create the endpoint. For Gateway Endpoints, you select the VPC and the route tables to associate. For Interface Endpoints, you select the VPC, subnets (where the ENI will be created), and optionally a security group. This step provisions the virtual network component.
4. **Configure Routes or DNS** — For Gateway Endpoints, AWS automatically adds a route to your selected route tables directing traffic for the service to the endpoint. For Interface Endpoints, you enable Private DNS so that the service's public DNS name resolves to the endpoint's private IP. Without this, traffic might still go over the internet.
5. **Attach an Endpoint Policy** — Optionally, you attach a JSON policy document to the endpoint to restrict which resources (e.g., specific S3 buckets) or actions (e.g., only GetObject) can be performed through the endpoint. This provides granular security and is critical for compliance.
6. **Test and Verify Connectivity** — From a resource inside your VPC (like an EC2 instance), test accessing the AWS service using its standard DNS name. Verify that the connection succeeds and that traffic is not leaving the VPC to the internet. You can use tools like traceroute or VPC Flow Logs to confirm.

## Comparisons

### Gateway Endpoint vs Interface Endpoint

**Gateway Endpoint:**
- Only for S3 and DynamoDB
- Free of charge
- Uses route tables, no security groups

**Interface Endpoint:**
- For all other supported AWS services
- Charged per hour and per GB
- Uses security groups and DNS resolution

### VPC Peering vs AWS PrivateLink

**VPC Peering:**
- Connects two entire VPCs
- Requires non-overlapping CIDR blocks
- Allows full bidirectional IP-level connectivity

**AWS PrivateLink:**
- Connects one VPC to a specific service in another
- No CIDR overlap concerns
- Provides one-way, service-level access only

### Internet Gateway vs VPC Endpoint

**Internet Gateway:**
- Opens your VPC to the public internet
- Traffic leaves AWS network
- Required for resources that need public access

**VPC Endpoint:**
- Keeps traffic within AWS network
- No public internet exposure
- Used for private access to AWS services

## Diagram

_A flowchart showing how Gateway and Interface Endpoints in your VPC connect to different AWS services, bypassing the public internet._

```mermaid
flowchart TD
    A[Your VPC] --> B[Gateway Endpoint]
    A --> C[Interface Endpoint]
    B --> D[Amazon S3]
    B --> E[Amazon DynamoDB]
    C --> F[AWS Lambda]
    C --> G[Amazon SQS]
    C --> H[Other AWS Services]
    C --> I[Third-Party Service via PrivateLink]
    A --> J[Internet Gateway]
    J --> K[Public Internet]
```

## Common misconceptions

- **Misconception:** VPC Endpoints allow your VPC to communicate with any AWS service over the internet. **Reality:** VPC Endpoints specifically keep traffic within the AWS network, bypassing the public internet entirely. (The word 'endpoint' sounds like a connection point, leading beginners to assume it uses the public internet, when its entire purpose is the opposite.)
- **Misconception:** Gateway Endpoints are more secure than Interface Endpoints. **Reality:** Both are secure, but they use different security models. Gateway Endpoints use route tables and endpoint policies. Interface Endpoints use security groups and endpoint policies. Neither is inherently 'more secure'. (Beginners often assume that 'free' means less capable or less secure, leading them to a false comparison.)
- **Misconception:** You can use a Gateway Endpoint for a service like Amazon SQS or Amazon API Gateway. **Reality:** Gateway Endpoints only support Amazon S3 and DynamoDB. All other services require Interface Endpoints via PrivateLink. (The memory trick 'S3 and DynamoDB' is so specific that beginners forget that it is a complete list and assume other services might also work with Gateway Endpoints.)
- **Misconception:** PrivateLink and VPC Peering are the same thing. **Reality:** VPC Peering connects two VPCs directly and allows full IP-level connectivity between them. PrivateLink allows you to connect to a specific service in another VPC without full network exposure. (Both provide private connectivity between VPCs, causing confusion. The difference is granularity: peering is a network-wide bridge; PrivateLink is a one-way, service-specific connection.)
- **Misconception:** Creating a VPC Endpoint automatically secures all traffic from your VPC to the service. **Reality:** You must also configure route tables (for Gateway Endpoints) or DNS resolution and security groups (for Interface Endpoints), and optionally endpoint policies, to actually control and secure the traffic. (Beginners think that simply creating the endpoint is a 'set and forget' security solution, when it is just the infrastructure — the policies and routes are the real security.)

## Key takeaways

- Gateway Endpoints are free and only work for Amazon S3 and DynamoDB, using route tables to direct traffic.
- Interface Endpoints are powered by AWS PrivateLink and are used for all other supported AWS services, costing an hourly and per-GB fee.
- PrivateLink is the underlying technology that creates a private, one-way connection to a specific service using Network Load Balancers and Elastic Network Interfaces.
- To keep traffic completely off the public internet, you must use a VPC Endpoint; a VPN is not sufficient if the traffic goes through the internet gateway.
- Endpoint Policies are IAM-based permission documents that allow you to restrict what resources or actions can be accessed via the endpoint, preventing data exfiltration.
- For Interface Endpoints, you must enable Private DNS for the standard AWS service DNS names to resolve to the endpoint's private IP address.
- Both Gateway and Interface Endpoints can be configured with endpoint policies, but only Interface Endpoints can be associated with security groups.
- When you create a PrivateLink service, you must configure a Network Load Balancer to serve as the front-end for your application.

## FAQ

**What is the difference between a Gateway Endpoint and an Interface Endpoint?**

A Gateway Endpoint works by adding a route to your route table and only works with Amazon S3 and DynamoDB, and it is free. An Interface Endpoint creates an Elastic Network Interface with a private IP in your subnet, works with many other services, costs money, and uses PrivateLink.

**Do I need a VPC Endpoint to use an AWS service?**

No, you can access AWS services from your VPC over the public internet via an Internet Gateway. A VPC Endpoint is only needed when you want to keep the traffic within the AWS network and avoid the public internet for security, compliance, or performance reasons.

**Can I use a VPC Endpoint to connect to a service in another AWS account?**

Yes, you can. If the other account has configured their service as a PrivateLink endpoint service and granted your account permissions, you can create an Interface Endpoint in your VPC to connect to it privately.

**How do I make my application available to other VPCs privately using AWS PrivateLink?**

You must first create a Network Load Balancer (NLB) in front of your application in your VPC. Then, create a VPC Endpoint Service configuration pointing to that NLB. Other accounts can then create Interface Endpoints in their VPCs to connect to your service via your NLB.

**Why is my Interface Endpoint not resolving DNS correctly?**

You most likely need to enable the 'Private DNS name' option when creating the Interface Endpoint. This ensures that the standard AWS DNS names for the service resolve to the endpoint's private IP address instead of the public IP.

**Can I restrict which S3 buckets my Gateway Endpoint can access?**

Yes, you can attach a VPC Endpoint Policy to the Gateway Endpoint. This is an IAM-like JSON document that defines which resources (buckets) and actions (like GetObject) are allowed, preventing access to other buckets in the same or different accounts.

## Check your understanding

1. **Which two AWS services can be accessed using a Gateway VPC Endpoint?**

   Answer: Amazon S3 and Amazon DynamoDB.

2. **What underlying technology powers Interface VPC Endpoints?**

   Answer: AWS PrivateLink.

3. **What must a provider configure to offer their application as a PrivateLink service?**

   Answer: A Network Load Balancer (NLB) in front of their application.

4. **What is the purpose of enabling 'Private DNS name' when creating an Interface Endpoint?**

   Answer: It ensures that the standard AWS service DNS names resolve to the endpoint's private IP address instead of a public IP.

5. **Can you attach a security group to a Gateway Endpoint?**

   Answer: No. Gateway Endpoints cannot have security groups; they rely on route tables and endpoint policies for security.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/aws-networking-specialty/private-connectivity-and-vpc-endpoints