AWS PrivateLink
Network SecurityAWS PrivateLink enables you to access AWS services and third-party services privately through VPC interface endpoints. Traffic stays on the AWS network and never traverses the public internet.
Components
- Interface VPC Endpoint: an ENI with a private IP in your subnet that serves as an entry point for traffic to a supported service
- Gateway Load Balancer Endpoint: for routing traffic to security appliances
- Endpoint Service: your own service fronted by a Network Load Balancer that other VPCs can access via PrivateLink
Security Benefits
- No internet gateway, NAT device, or public IP required
- Traffic is isolated from the public internet
- Endpoint policies can restrict which API actions are allowed through the endpoint
- Security groups on the interface endpoint control access
Common Use Cases
- Access AWS services (S3, DynamoDB, STS, KMS) from private subnets
- Expose your microservices to other VPCs or AWS accounts without VPC peering
- Connect to SaaS products (Datadog, Snowflake) privately
Related AWS Services
Related Terms
A private connection between your VPC and an AWS service that keeps traffic within the AWS network, eliminating the need for internet access.
An isolated virtual network within AWS where you launch resources, with full control over IP addressing, subnets, route tables, and network gateways.
Dividing a network into isolated segments (subnets, VPCs) to limit lateral movement and contain the blast radius of a security breach.
A security model where no user, device, or network is trusted by default - every access request is verified regardless of location, using identity-based policies and continuous validation.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.