Skip to main content
LetMeMaster
Search Loading account Sign in

AWS PrivateLink

Private connectivity to services and resources as if they were in your VPC: interface endpoints for AWS services, endpoint services behind Network Load Balancers, resource endpoints, Gateway Load Balancer endpoints, gateway endpoints for S3 and DynamoDB, private DNS, cross-Region access, security, and pricing.

5 min read · Last reviewed · SAA-C03

Loading your progress

Sign in to bookmark tutorials and track what you have read.

On this page

What it is

AWS PrivateLink is a HA (High availability)The ability of a system to keep serving users when parts of it fail, usually by running redundant copies across Availability Zones and failing over automatically. It is often stated as a percentage of uptime, such as 99.99%.Glossary entry, scalable technology that privately connects your VPC to services and resources as if they were in your VPC. Traffic uses private IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry addresses and stays on the AWS network, with no internet gateway, NAT (Network address translation)Rewriting the IP addresses in packets as they pass through a device, most often so that many private addresses can share one public address to reach the internet.Glossary entry device, public IP address, Direct Connect, or VPN (Virtual private network)An encrypted tunnel over a public network, such as the internet, that joins networks or devices as if they were directly connected. AWS Site-to-Site VPN connects networks; AWS Client VPN connects individual users.Glossary entry needed to reach the service from SubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entry. You also control exactly which services and resources are reachable, instead of connecting whole networks.

Choose PrivateLink when a question asks to reach an AWS service or a partner's service privately, or to expose your own service to other VPCs or accounts without peering the networks, especially when CIDR (Classless Inter-Domain Routing)A notation for a range of IP addresses: an address, a slash, and the number of fixed leading bits, such as 10.0.0.0/16 for 65,536 addresses. VPCs and subnets are defined by CIDR blocks; the smaller the number after the slash, the larger the range.Glossary entry ranges overlap.

Types of VPC endpoints

Endpoint type What it connects to Notes
VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry Many AWS services (such as SQS, KMS, Secrets Manager, ECR, CloudWatch), or an endpoint service hosted by another account Network interfaces with private IPs in your subnets; billed hourly per AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry and per GB
Gateway endpoint Amazon S3 and DynamoDB only A route table target, not PrivateLink; no charge
Gateway Load Balancer endpoint An inspection system, such as firewalls, behind a Gateway Load Balancer Routes traffic through security appliances
Resource endpoint A specific VPC resource in another VPC, such as a database, an EC2 instance, a domain name, or an IP address No load balancer needed in front of the resource
Service-network endpoint A VPC Lattice service network of services and resources For larger service-to-service setups

S3 and DynamoDB support both gateway endpoints and interface endpoints. Choose gateway endpoints for free access from inside the VPC, and interface endpoints when On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry networks or other AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry need access.

Sharing your own service

  • As a service provider, put your service behind a Network Load Balancer and create a VPC endpoint service.
  • Grant access to specific accounts or PrincipalA person or workload that can make requests to AWS, such as an IAM user, a role session, the root user, a federated user, or an AWS service. Resource-based policies name the principals they allow.Glossary entry, and accept or reject their connection requests.
  • Consumers in other VPCs or accounts create interface endpoints to reach it. They see only that service, not your network.
  • Because traffic goes through endpoints, overlapping CIDRs don't matter.
Sharing a service with PrivateLink. In the consumer VPC, an application connects to an interface endpoint. Over PrivateLink, the endpoint reaches an endpoint service in the provider VPC, which forwards to a Network Load Balancer in front of the provider's service. The consumer sees only the service, not the provider's network.

DNS and Regions

  • With private DNS (Domain Name System)The internet's directory, which translates domain names such as example.com into IP addresses that computers use to connect. Amazon Route 53 is the AWS DNS service.Glossary entry enabled (which needs DNS hostnames and DNS resolution on the VPC), the service's default name, such as sqs.us-east-1.amazonaws.com, resolves to the endpoint's private IPs, so applications need no code changes.
  • Cross-Region PrivateLink: some AWS services, and endpoint services that enable it, can be reached through an interface endpoint in another Region.

Security, resilience, performance, and cost

Security

  • Use endpoint policies (IAM resource policies on the endpoint) to limit what can be done through it, and Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry on interface endpoints.
  • Combine with resource policies, for example an S3 bucket policy that allows access only through a specific VPC endpoint (aws:SourceVpce).

Resilience

  • Create interface endpoints in subnets in several Availability Zones.

Cost

  • Interface endpoints: per hour per Availability Zone, plus per GB processed, with tiered pricing. Cross-Region endpoints add an hourly charge per remote Region.
  • Gateway endpoints: free, and they can lower NAT gatewayA managed VPC component that lets instances in private subnets start connections to the internet or other networks, while blocking connections started from outside. It is billed per hour and per gigabyte processed.Glossary entry data processing costs.
If the requirement is Choose
Private access to S3 or DynamoDB from within the VPC, free Gateway endpoint
Private access to other AWS services from private subnets Interface endpoint (PrivateLink)
Share one service with many consumer VPCs, even with overlapping CIDRs Endpoint service behind an NLB
Full network connectivity between VPCs VPC peering or Transit Gateway
Send traffic through third-party firewalls Gateway Load Balancer endpoint

Reverse mindmap: when the question points here

Is it AWS PrivateLink?
  • Yes, when the question says
    • Reach AWS services without internet or NAT leads to Interface endpoint
    • Expose our service to other accounts privately leads to Endpoint service with an NLB
    • Consumers have overlapping CIDRs leads to PrivateLink, not peering
    • Reach one database in another VPC leads to Resource endpoint
  • Choose the endpoint
    • S3 or DynamoDB, free leads to Gateway endpoint, not PrivateLink
    • S3 from on premises over Direct Connect leads to S3 interface endpoint
    • Inspect traffic with firewalls leads to Gateway Load Balancer endpoint
  • Lock it down
    • Bucket only reachable through our endpoint leads to Bucket policy with aws:SourceVpce
    • Limit actions through the endpoint leads to Endpoint policy
  • No, when the question says
    • Connect whole networks leads to Peering or Transit Gateway

Key takeaways

  • PrivateLink connects VPCs privately to services and resources, without internet, NAT, VPN, or Direct Connect.
  • Interface endpoints reach AWS services and endpoint services; gateway endpoints (S3 and DynamoDB) are separate, free, and route-table based.
  • Share your own service with an endpoint service behind a Network Load Balancer; overlapping CIDRs are fine.
  • Private DNS keeps service names unchanged; endpoint policies and security groups restrict access.
  • Interface endpoints are billed per AZ-hour and per GB.

Sources

Check your understanding

Loading your quiz progress

Sign in to check your understanding with 12 questions on AWS PrivateLink.

Glossary Install the app

LetMeMaster is an independent educational project and is not affiliated with or endorsed by Amazon Web Services. Practice results do not predict actual exam outcomes.

© 2026 LetMeMaster. All rights reserved. Content may not be copied or redistributed without permission.

Proudly made in Canada

Add LetMeMaster to your Home Screen

  1. Tap the Share button in your browser's toolbar. In Safari it is at the bottom of the screen, or at the top on iPad.
  2. Scroll down and tap Add to Home Screen.
  3. Tap Add. Open LetMeMaster from its icon on your Home Screen.