AWS PrivateLink
- What it is
- Private connectivity between VPCs, AWS services, and on-premises networks without traversing the public internet.
- Traffic never leaves the AWS network — no internet gateway, NAT gateway, VPN, or public IP required.
- The mechanism: VPC endpoints
- Interface endpoint (PrivateLink) — an elastic network interface with a private IP in your subnet that fronts a service. Works for most AWS services, AWS Marketplace SaaS partners, and your own services. Charged hourly plus per GB.
- Gateway endpoint — a route table entry, free, but only for Amazon S3 and Amazon DynamoDB.
- Gateway Load Balancer endpoint — see Gateway Load Balancer (GWLB).
- Exposing your own service
- Put a Network Load Balancer (NLB) in front of it, create an endpoint service, and consumers in other VPCs or accounts connect privately — with no VPC peering, no route table changes, and no overlapping-CIDR problems.
- Why it matters
- Security and compliance: keep S3 or API traffic off the internet entirely.
- One-way connectivity — the consumer initiates; the provider cannot reach back into the consumer’s VPC.
- Not to be confused with
- VPC peering — connects two whole VPCs bidirectionally, requires non-overlapping CIDRs, and does not scale past a handful of VPCs.
- Transit Gateway — a hub for routing many VPCs and on-premises networks together at the network layer. PrivateLink exposes a single service, not a network.