VPC Endpoints and PrivateLink

A hand-drawn animated video with a voice and subtitles. Every fact in it comes from the official AWS documentation (listed at the end).

TL;DR

Without an endpoint, a server in a private subnet reaches an AWS service like S3 through a NAT gateway and the internet gateway. The traffic leaves your VPC, but it stays in the AWS network.
AWS PrivateLink connects your VPC to services "as if they were in your VPC". No internet gateway, NAT device or public IP address is needed.
A VPC endpoint is what you create to use it. Two common types: gateway endpoint (S3 and DynamoDB, a route table target, no additional charge, does not use PrivateLink) and interface endpoint (a network interface with a private IP in your subnet, billed per hour and per GB).
Interface endpoints have a security group. Both types can have an endpoint policy; the default one allows full access.
You can share your own service as an endpoint service behind a Network Load Balancer. Consumers connect with an interface endpoint.

0:00

Video file: aws-understand/06-networking/24-vpc-endpoints-and-privatelink/video.mp4

The ideas

01The picture, part by part

Same city picture as the earlier videos AWS docs

AWS word	In the picture	What AWS docs say
`VPC`	Gated society	A logically isolated virtual network.
AWS service (S3, DynamoDB)	A shop in the city	You access an AWS service using an endpoint. The default service endpoints are public interfaces.
AWS PrivateLink	A private lane	Privately connects your VPC to services and resources as if they were in your VPC.
Gateway endpoint	A signpost in the route table	A route to the endpoint is added to the route tables you pick.
Interface endpoint	A small counter inside your building	An endpoint network interface in each subnet you pick, with a private IP from that subnet.
Security group	The guard at the counter	The security group for the endpoint network interface must allow the expected traffic.

Source: concepts.html, privatelink-access-aws-services.html, what-is-privatelink.html, gateway-endpoints.html, create-interface-endpoint.html

02The long way vs the private lane

Same letter, two paths AWS docs

Path	Route of the traffic	Needs
Public service endpoint, from a private subnet	Private subnet → NAT gateway → internet gateway → AWS service. It leaves your VPC but does not leave the AWS network.	NAT gateway + internet gateway
AWS PrivateLink (interface endpoint)	Private subnet → endpoint network interface → AWS service. Stays within the AWS network, without crossing the public internet.	No internet gateway, NAT device or public IP address

In everyday words

Without a lane, your letter to the shop goes to the post desk, out the main gate, and along the city road. With a lane, it goes straight from your building to the shop.

Source: privatelink-access-aws-services.html ("Overview"), what-is-privatelink.html, concepts.html ("AWS PrivateLink connections")

03Gateway endpoint

A route table signpost for S3 and DynamoDB AWS docs

Point	What AWS docs say
Services	Amazon S3 and DynamoDB.
Uses PrivateLink?	No. "Gateway endpoints do not use AWS PrivateLink, unlike other types of VPC endpoints."
Charge	No additional charge.
How it works	You pick route tables. AWS adds a route: destination = the service's prefix list, target = the gateway endpoint. You cannot edit or delete that route.
Route choice	The most specific route wins, so S3 or DynamoDB traffic in the same Region uses the endpoint even if there is a `0.0.0.0/0` route to an internet gateway.
Limits	Only in the Region where you created it. Not usable from on-premises networks, from peered VPCs in other Regions, or through a transit gateway. For those, use an interface endpoint (extra cost).

Source: gateway-endpoints.html ("Routing"), vpc-endpoints-s3.html, concepts.html

04Interface endpoint

A counter with a private IP, powered by PrivateLink AWS docs

Point	What AWS docs say
What AWS creates	For each subnet you pick, an endpoint network interface with a private IP address from the subnet range.
Who manages it	It is requester-managed: you can view it in your account, but you can't manage it yourself.
Subnets	One subnet per Availability Zone. For production, AWS recommends at least two Availability Zones.
Private DNS	A hidden, AWS-managed private hosted zone makes the service's default DNS name point to the endpoint's private IPs, so existing apps need no change. Needs DNS hostnames and DNS resolution on in the VPC. AWS recommends enabling it.
Charge	Billed per hour in each Availability Zone, and per GB of data processed.

In everyday words

DNS is the phone book that turns a name into an IP address. With private DNS, the old name in the phone book now points to your counter.

Source: create-interface-endpoint.html, privatelink-access-aws-services.html ("Private DNS", "Subnets and Availability Zones", "Pricing")

05Guards and policies

Security group on the counter, policy on the endpoint AWS docs

Control	What AWS docs say
Security group (interface endpoint)	Must allow the expected traffic, for example inbound HTTPS. By default, AWS associates the VPC's default security group.
Security group (gateway endpoint)	The instances' own security groups must allow traffic to and from the service (you can reference the service's prefix list).
Endpoint policy	A resource-based policy that controls which principals can use the endpoint. The default policy grants full access.
Other policies	An endpoint policy does not override or replace identity-based or resource-based policies, such as S3 bucket policies.

Source: create-interface-endpoint.html ("Prerequisites"), gateway-endpoints.html ("Security"), vpc-endpoints-access.html

06Share your own service

Service provider and service consumer AWS docs

Who	Does what
Service provider	Puts a Network Load Balancer in front of the service and creates an endpoint service. It is not available to anyone until the provider adds permissions for specific AWS principals.
Service consumer	Creates an interface endpoint to the endpoint service.
Connection	The consumer starts the connection; the provider accepts or rejects the request.

Source: privatelink-share-your-services.html, concepts.html ("Endpoint services", "AWS PrivateLink connections")

07Gateway or interface?

The interview answer AWS docs

	Gateway endpoint	Interface endpoint
Services	S3 and DynamoDB	Many AWS services, and endpoint services
Uses PrivateLink	No	Yes
How traffic finds it	Route table target (prefix list)	DNS resolves to private IPs in your subnets
Security groups	Your instances' own security groups must allow traffic to and from the service	The endpoint network interface has its own security group
From on-premises / peered VPC in another Region	No	Yes (AWS docs: "use an interface endpoint")
Charge	No additional charge	Per hour per Availability Zone + per GB

One more type exists: a Gateway Load Balancer endpoint sends traffic to a fleet of virtual appliances, used for things like security inspection. AWS docs also list resource, tunnel and service-network endpoints.

Source: gateway-endpoints.html, vpc-endpoints-s3.html, concepts.html, vpce-gateway-load-balancer.html, privatelink-access-aws-services.html

Reference

—Sources

What	Where (official AWS docs)
What is AWS PrivateLink?	vpc/latest/privatelink/what-is-privatelink.html
PrivateLink concepts: endpoint types, provider, consumer, policies	vpc/latest/privatelink/concepts.html
Gateway endpoints: routing, pricing, security	vpc/latest/privatelink/gateway-endpoints.html
Gateway endpoints for Amazon S3: limits	vpc/latest/privatelink/vpc-endpoints-s3.html
Access AWS services: long way, private DNS, zones, pricing	vpc/latest/privatelink/privatelink-access-aws-services.html
Create an interface endpoint: network interface, security group	vpc/latest/privatelink/create-interface-endpoint.html
Endpoint policies	vpc/latest/privatelink/vpc-endpoints-access.html
Share your services	vpc/latest/privatelink/privatelink-share-your-services.html
Gateway Load Balancer endpoints	vpc/latest/privatelink/vpce-gateway-load-balancer.html