1. What is PrivateLink?

AWS PrivateLink provides private connectivity between VPCs, AWS services, and on-premises networks without exposing traffic to the public internet. Traffic stays entirely within the AWS network.

Core Concept PrivateLink = private access to services via ENIs in YOUR VPC. Instead of traffic going over the internet to reach an AWS service or another VPC’s service, PrivateLink creates an Elastic Network Interface (ENI) in your subnet with a private IP. Traffic goes to VPC → ENI → AWS backbone → service. Never touch the internet.

2. VPC Endpoints (Two Types)

Important Warning Gateway Endpoints are FREE but only support S3 and DynamoDB. Interface Endpoints cost money but support 100+ services and are accessible from on-premises. For S3, you can use EITHER type: Gateway (free, route table) or Interface (paid, ENI — needed when on-prem access is required). This is a very common exam distinction.

3. Interface Endpoint Architecture

Interface Endpoint (PrivateLink):

  Your VPC (10.0.0.0/16)
  ┌───────────────────────────┐
  | Private Subnet AZ-a        |
  |   EC2 Instance             |
  |     |                      |
  |   Interface Endpoint ENI   |  <── Private IP: 10.0.10.55
  |   (vpce-xxx)               |
  └────────────┬──────────────┘
               |
         AWS Backbone (private)
               |
         AWS Service (e.g., SQS, KMS, Secrets Manager)

  Private DNS enabled:
    sqs.us-east-1.amazonaws.com → 10.0.10.55 (private IP)
    No code changes needed. SDK uses the same endpoint URL.

  Security Group on ENI:
    Allow inbound HTTPS (443) from your VPC CIDR

4. VPC Endpoint Services (Your Own PrivateLink)

You can expose YOUR own services to other VPCs/accounts via PrivateLink, so consumers access your service through private IPs without VPC peering.

Your PrivateLink Service (Provider Side):

  Provider VPC:
    NLB (Network Load Balancer)
      |
    Your Service (EC2, ECS, Lambda targets)
      |
    VPC Endpoint Service (register NLB as the service)

  Consumer VPC:
    Interface Endpoint (vpce-xxx)
      → ENI with private IP in the consumer’s subnet
      → Traffic goes: Consumer ENI → AWS backbone → Provider NLB

  Key Points:
    • Consumer sees only a private IP (never sees your VPC CIDR)
    • Provider can whitelist consumer accounts
    • No VPC peering needed (no CIDR overlap issues)
    • One-directional: consumer → provider only
    • Scales to thousands of consumers

PrivateLink vs Peering vs TGW

5. PrivateLink Use Cases

6. VPC Endpoint Policies

  1. JSON policies (similar to IAM) that control WHAT actions are allowed through the endpoint
  2. Apply to both Gateway and Interface Endpoints
  3. Example: restrict S3 Gateway Endpoint to only allow access to specific buckets
  4. Example: restrict the KMS Interface Endpoint to only allow specific key operations
  5. Endpoint policies are ADDITIONAL to IAM policies (both must allow)
  6. Use for: least-privilege access through endpoints, compliance, and data exfiltration prevention
S3 Gateway Endpoint Policy Example:

{
  "Statement": [{
    "Effect": "Allow",
    "Principal": "*",
    "Action": ["s3:GetObject", "s3:PutObject"],
    "Resource": [
      "arn:aws:s3:::my-approved-bucket",
      "arn:aws:s3:::my-approved-bucket/*"
    ]
  }]
}

Result: instances can only access my-approved-bucket via this endpoint.
         Access to ANY other S3 bucket is denied through this endpoint.

7. PrivateLink + NAT Gateway Cost Comparison

Cost Comparison (accessing AWS services from private subnet):

Option A: NAT Gateway
  $0.045/hr × 730 hrs = $32.85/month (just for running)
  + $0.045/GB data processing
  Traffic: Internet → AWS service (public endpoint)

Option B: Interface Endpoint (per AZ)
  $0.01/hr × 730 hrs = $7.30/month per AZ (×2 AZs = $14.60)
  + $0.01/GB data processing
  Traffic: Private → AWS backbone (never internet)

Verdict: For specific high-traffic services, Interface Endpoints
are CHEAPER than NAT Gateway + more secure (no internet).
For S3 and DynamoDB, Gateway Endpoints are FREE.
Exam Tip PrivateLink: "Access AWS service without internet" = VPC Endpoint. "S3 + DynamoDB free" = Gateway Endpoint. "100+ services" = Interface Endpoint (PrivateLink). "On-prem access" = Interface Endpoint only (not Gateway). "Expose your service to other VPCs" = Endpoint Service (NLB + PrivateLink). "Overlapping CIDRs OK" = PrivateLink (not peering/TGW). "Restrict endpoint access" = Endpoint Policy. "Cheaper than NAT GW" = Interface Endpoints for high-traffic services. "Compliance: no internet" = all traffic via endpoints.