AWS PrivateLink

AWS PrivateLink enables you to access AWS services and third-party services privately through VPC interface endpoints. Traffic stays on the AWS network and never traverses the public internet.

Components

• Interface VPC Endpoint: an ENI with a private IP in your subnet that serves as an entry point for traffic to a supported service
• Gateway Load Balancer Endpoint: for routing traffic to security appliances
• Endpoint Service: your own service fronted by a Network Load Balancer that other VPCs can access via PrivateLink

Security Benefits

• No internet gateway, NAT device, or public IP required
• Traffic is isolated from the public internet
• Endpoint policies can restrict which API actions are allowed through the endpoint
• Security groups on the interface endpoint control access

Common Use Cases

• Access AWS services (S3, DynamoDB, STS, KMS) from private subnets
• Expose your microservices to other VPCs or AWS accounts without VPC peering
• Connect to SaaS products privately

Endpoint Policies, Precisely

An endpoint policy is a resource-based policy attached to a VPC endpoint that controls which AWS principals can use the endpoint to reach a service. It does not override or replace identity-based or resource-based policies; all of them still apply. Key details:

• The default endpoint policy grants full access: Principal of *, Action of *, Resource of *. If you do not attach a policy, that is what you get
• The policy must contain a Principal element, and for gateway endpoints the Principal must be *, with specific principals expressed through the aws:PrincipalArn condition key
• Maximum size is 20,480 characters including whitespace
• Not every AWS service supports endpoint policies; where a service does not, full access to the endpoint is allowed
• For endpoint services other than AWS services, full access to the endpoint is allowed
• Changes can take a few minutes to take effect

Quotas worth knowing: 50 interface and Gateway Load Balancer endpoints per VPC by default (a combined quota, adjustable), 20 gateway endpoints per Region by default with up to 255 gateway endpoints per VPC, and a VPC endpoint policy character limit of 20,480 that is not adjustable. Each endpoint supports up to 10 Gbps per Availability Zone and scales automatically to 100 Gbps, with an MTU of 8500 bytes and no Path MTU Discovery support.

How It Goes Wrong in Practice

The most common mistake is deploying endpoints and believing the exfiltration path is closed. A team moves workloads into private subnets, adds an S3 gateway endpoint, and declares data exfiltration solved. But the default endpoint policy allows everything, so an attacker with instance credentials can still write to any S3 bucket in any AWS account through that endpoint. The endpoint changed the network path, not the authorization. Closing the gap means an endpoint policy that restricts the resources and principals allowed through it, typically using aws:PrincipalOrgID to require the caller belong to your organization and listing the bucket ARNs your workload legitimately uses.

The second recurring problem is private DNS assumptions. An interface endpoint with private DNS enabled makes the standard service hostname resolve to the endpoint's private IPs inside the VPC. If private DNS is not enabled, or if the VPC does not have DNS hostnames and DNS resolution turned on, your SDK calls keep resolving to the public endpoint and quietly go out through the NAT gateway. Everything works, the bill shows NAT data processing charges, and the traffic you thought was private is not. Check PrivateDnsEnabled on every interface endpoint you rely on for isolation.

Third, security groups on interface endpoints get forgotten. An interface endpoint is an ENI, so it has security groups, and the default is often the VPC default security group. Either it is too permissive (every resource in the VPC can use the endpoint, undermining segmentation) or too restrictive (only traffic from the default group works, and applications in other groups fail with timeouts that look like DNS problems). Set the endpoint's security group deliberately, allowing HTTPS from the specific source security groups that should use it.

Auditing Endpoints From the CLI

To list interface endpoints in a VPC with their policies and DNS state:

aws ec2 describe-vpc-endpoints --filters Name=vpc-id,Values=vpc-0123456789abcdef0 Name=vpc-endpoint-type,Values=Interface

Valid filter names include vpc-id, vpc-endpoint-id, vpc-endpoint-type (Interface, Gateway, GatewayLoadBalancer, Resource, ServiceNetwork), service-name, vpc-endpoint-state, and ip-address-type. The output per endpoint includes VpcEndpointId, ServiceName, State, PolicyDocument, SubnetIds, NetworkInterfaceIds, Groups (the security groups), DnsEntries, and PrivateDnsEnabled. Two things to check on every result: is PolicyDocument still the wide-open default, and is PrivateDnsEnabled true. To change a policy, use aws ec2 modify-vpc-endpoint.

Frequently Asked Questions

What is the difference between a gateway endpoint and an interface endpoint?

Gateway endpoints exist only for S3 and DynamoDB, are configured through route table entries, and are free. Interface endpoints create an ENI with a private IP in your subnet, work for a long list of services and for third-party endpoint services, support security groups and private DNS, and are billed per hour and per GB. Both support endpoint policies.

Does PrivateLink encrypt my traffic?

PrivateLink controls the path, not the encryption. Traffic to AWS service endpoints is still TLS-protected because the service endpoints use HTTPS. If you expose your own service through an endpoint service, terminating TLS is your responsibility. Do not treat "stays on the AWS network" as a substitute for encryption in transit.

Can an endpoint policy stop access to buckets in other accounts?

Yes, and that is one of its best uses. An endpoint policy that limits Resource to your own bucket ARNs, or that requires aws:PrincipalOrgID to match your organization, prevents traffic through that endpoint from reaching third-party buckets. Combine it with an SCP and with bucket policies for defense in depth, since the endpoint policy only governs traffic that actually uses the endpoint.