Interface VPC endpoints (AWS PrivateLink)
An interface VPC endpoint (interface endpoint) enables you to connect to services powered by AWS PrivateLink. These services include some AWS services, services hosted by other AWS customers and Partners in their own VPCs (referred to as endpoint services), and supported AWS Marketplace Partner services. The owner of the service is the service provider, and you, as the principal creating the interface endpoint, are the service consumer.
The following are the general steps for setting up an interface endpoint:
-
Choose the VPC in which to create the interface endpoint, and provide the name of the AWS service, endpoint service, or AWS Marketplace service to which you're connecting.
-
Choose a subnet in your VPC to use the interface endpoint. We create an endpoint network interface in the subnet. You can specify more than one subnet in different Availability Zones (as supported by the service) to help ensure that your interface endpoint is resilient to Availability Zone failures. In that case, we create an endpoint network interface in each subnet that you specify.
Note An endpoint network interface is assigned a private IP address from the IP address range of your subnet, and keeps this IP address until the interface endpoint is deleted.
An endpoint network interface is a requester-managed network interface. You can view it in your account, but you cannot manage it yourself. For more information, see Requester-managed network interfaces.
-
Specify the security groups to associate with the endpoint network interface. The security group rules control the traffic to the endpoint network interface from resources in your VPC. If you do not specify a security group, we associate the default security group for the VPC.
-
(Optional, AWS services and AWS Marketplace Partner services only) Enable private DNS for the endpoint to enable you to make requests to the service using its default DNS hostname.
Important Private DNS is enabled by default for endpoints created for AWS services and AWS Marketplace Partner services.
Private DNS is enabled in the other subnets which are in the same VPC and Availability Zone or Local Zone.
-
When the service provider and the consumer are in different accounts, see Interface endpoint Availability Zone considerations for information about how to use Availability Zone IDs to identify the interface endpoint Availability Zone.
-
After you create the interface endpoint, it's available to use when it's accepted by the service provider. The service provider must configure the service to accept requests automatically or manually. AWS services and AWS Marketplace services generally accept all endpoint requests automatically. For more information about the lifecycle of an endpoint, see Interface endpoint lifecycle.
Services cannot initiate requests to resources in your VPC through the endpoint. An endpoint only returns responses to traffic that is initiated from resources in your VPC. Before you integrate a service and an endpoint, review the service-specific VPC endpoint documentation for any service-specific configuration and limitations.
Contents
- Private DNS for interface endpoints
- Interface endpoint properties and limitations
- Connection to on-premises data centers
- Interface endpoint lifecycle
- Interface endpoint Availability Zone considerations
- Pricing for interface endpoints
- Viewing available AWS service names
- Creating an interface endpoint
- Viewing your interface endpoint
- Creating and managing a notification for an interface endpoint
- Accessing a service through an interface endpoint
- Modifying an interface endpoint
Private DNS for interface endpoints
When you create an interface endpoint, we generate endpoint-specific DNS hostnames
that you can use to communicate with the service. For AWS services and AWS Marketplace
Partner services, the private DNS option (enabled by default) associates a private
hosted zone with your VPC. The hosted zone contains a record set for the default DNS
name for the service (for example, ec2.us-east-1.amazonaws.com) that
resolves to the private IP addresses of the endpoint network interfaces in your VPC.
This enables you to make requests to the service using its default DNS hostname
instead of the endpoint-specific DNS hostnames. For example, if your existing
applications make requests to an AWS service, they can continue to make requests
through the interface endpoint without requiring any configuration changes.
In the example shown in the following diagram, there is an interface endpoint for Amazon Kinesis Data Streams and an endpoint network interface in subnet 2. Private DNS for the interface endpoint is not enabled. The route tables for the subnets have the following routes.
| Subnet 1 | |
| Destination | Target |
| 10.0.0.0/16 | Local |
| 0.0.0.0/0 | internet-gateway-id |
| Subnet 2 | |
| Destination | Target |
| 10.0.0.0/16 | Local |
Instances in either subnet can send requests to Amazon Kinesis Data Streams through the interface endpoint using an endpoint-specific DNS hostname. Instances in subnet 1 can communicate with Amazon Kinesis Data Streams over public IP address space in the AWS Region using its default DNS name.
In the next diagram, private DNS for the endpoint has been enabled. Instances in either subnet can send requests to Amazon Kinesis Data Streams through the interface endpoint using either the default DNS hostname or the endpoint-specific DNS hostname.
To use private DNS, you must set the following VPC attributes to
true: enableDnsHostnames and
enableDnsSupport. For more information, see Viewing and updating DNS support for your VPC. IAM users
must have permission to work with hosted zones. For more information,
see Authentication and Access Control for Route 53.
Interface endpoint properties and limitations
To use interface endpoints, you need to be aware of their properties and current limitations:
-
For each interface endpoint, you can choose only one subnet per Availability Zone.
-
Some services support the use of endpoint policies to control access to the service. For more information about the services that support endpoint policies, see Controlling access to services with VPC endpoints.
-
Services might not be available in all Availability Zones through an interface endpoint. To find out which Availability Zones are supported, use the describe-vpc-endpoint-services command or use the Amazon VPC console. For more information, see Creating an interface endpoint.
-
When you create an interface endpoint, the endpoint is created in the Availability Zone that is mapped to your account and that is independent from other accounts. When the service provider and the consumer are in different accounts, see Interface endpoint Availability Zone considerations for information about how to use Availability Zone IDs to identify the interface endpoint Availability Zone.
-
When the service provider and the consumer have different accounts and use multiple Availability Zones, and the consumer views the VPC endpoint service information, the response only includes the common Availability Zones. For example, when the service provider account uses
us-east-1aandus-east-1cand the consumer usesus-east-1aandus-east-1b, the response includes the VPC endpoint services in the common Availability Zone,us-east-1a. -
By default, each interface endpoint can support a bandwidth of up to 10 Gbps per Availability Zone. and bursts of up to 40Gbps. If your application needs higher bursts or sustained throughput, contact AWS support.
-
If the network ACL for your subnet restricts traffic, you might not be able to send traffic through the endpoint network interface. Ensure that you add appropriate rules that allow traffic to and from the CIDR block of the subnet.
-
Ensure that the security group that's associated with the endpoint network interface allows communication between the endpoint network interface and the resources in your VPC that communicate with the service. If the security group restricts inbound HTTPS traffic (port 443) from resources in the VPC, you might not be able to send traffic through the endpoint network interface.
-
An interface endpoint supports TCP traffic only.
-
When you create an endpoint, you can attach an endpoint policy to it that controls access to the service to which you are connecting. For more information, see Policy Best Practices and Controlling access to services with VPC endpoints.
-
Review the service-specific limits for your endpoint service.
-
Endpoints are supported within the same Region only. You cannot create an endpoint between a VPC and a service in a different Region.
-
Endpoints support IPv4 traffic only.
-
You cannot transfer an endpoint from one VPC to another, or from one service to another.
-
You have a quota on the number of endpoints you can create per VPC. For more information, see VPC endpoints.
Connection to on-premises data centers
You can use the following types of connections for a connection between an interface endpoint and your on-premises data center:
Interface endpoint lifecycle
An interface endpoint goes through various stages starting from when you create it (the endpoint connection request). At each stage, there might be actions that the service consumer and service provider can take.
The following rules apply:
-
A service provider can configure their service to accept interface endpoint requests automatically or manually. AWS services and AWS Marketplace services generally accept all endpoint requests automatically.
-
A service provider cannot delete an interface endpoint to their service. Only the service consumer that requested the interface endpoint connection can delete the interface endpoint.
-
A service provider can reject the interface endpoint after it has been accepted (either manually or automatically) and is in the
availablestate.
Interface endpoint Availability Zone considerations
When you create an interface endpoint, the endpoint is created in the Availability
Zone
that is mapped to your account and that is independent from other accounts. When
the
service provider and the consumer are in different accounts, use the Availability
Zone ID to uniquely and consistently identify the interface endpoint Availability
Zone. For example, use1-az1 is an Availability Zone ID for the
us-east-1 Region and maps to the same location in every AWS
account. For information about Availability Zone IDs, see AZ IDs for Your Resources in
the AWS RAM User Guide or use describe-availability-zones.
Services might not be available in all Availability Zones through an interface endpoint. You can use any of the following operations to find out which Availability Zones are supported for a service:
-
describe-vpc-endpoint-services (AWS CLI)
-
The Amazon VPC console when you create an interface endpoint. For more information, see Creating an interface endpoint.
Pricing for interface endpoints
You are charged for creating and using an interface endpoint to a service. Hourly
usage rates and data processing rates apply. For more information about interface
endpoint pricing, see AWS
PrivateLink Pricing
Viewing available AWS service names
When you use the Amazon VPC console to create an endpoint, you can get a list of available AWS service names.
When you use the AWS CLI to create an endpoint, you can use the describe-vpc-endpoint-services command to view the service names, and then create the endpoint using the create-vpc-endpoint command .
Creating an interface endpoint
To create an interface endpoint, you must specify the VPC in which to create the interface endpoint, and the service to which to establish the connection.
For AWS services, or AWS Marketplace Partner services, you can optionally enable private DNS for the endpoint to enable you to make requests to the service using its default DNS hostname.
Private DNS is enabled by default for endpoints created for AWS services and AWS Marketplace Partner services.
Viewing your interface endpoint
After you've created an interface endpoint, you can view information about it.
Creating and managing a notification for an interface endpoint
You can create a notification to receive alerts for specific events that occur on your interface endpoint. For example, you can receive an email when the interface endpoint is accepted by the service provider. To create a notification, you must associate an Amazon SNS topic with the notification. You can subscribe to the SNS topic to receive an email notification when an endpoint event occurs.
The Amazon SNS topic that you use for notifications must have a topic policy that allows Amazon's VPC endpoint service to publish notifications on your behalf. Ensure that you include the following statement in your topic policy. For more information, see Identity and Access Management in Amazon SNS in the Amazon Simple Notification Service Developer Guide.
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "vpce.amazonaws.com" }, "Action": "SNS:Publish", "Resource": "arn:aws:sns:region:account:topic-name" } ] }
Accessing a service through an interface endpoint
After you've created an interface endpoint, you can submit requests to the supported service via an endpoint URL. You can use the following:
-
If you have enabled private DNS for the endpoint (a private hosted zone; applicable to AWS services and AWS Marketplace Partner services only), the default DNS hostname for the AWS service for the Region. For example,
ec2.us-east-1.amazonaws.com. -
The endpoint-specific Regional DNS hostname that we generate for the interface endpoint. The hostname includes a unique endpoint identifier, service identifier, the Region, and
vpce.amazonaws.comin its name. For example,vpce-0fe5b17a0707d6abc-29p5708s.ec2.us-east-1.vpce.amazonaws.com. -
The endpoint-specific zonal DNS hostname that we generate for each Availability Zone in which the endpoint is available. The hostname includes the Availability Zone in its name. For example,
vpce-0fe5b17a0707d6abc-29p5708s-us-east-1a.ec2.us-east-1.vpce.amazonaws.com. You might use this option if your architecture isolates Availability Zones (for example, for fault containment or to reduce Regional data transfer costs).A request to the zonal DNS hostname is destined to the corresponding Availability Zone location in the service provider's account, which might not have the same Availability Zone name as your account. For more information, see Region and Availability Zone Concepts.
-
The private IP address of the endpoint network interface in the VPC.
To get the Regional and zonal DNS names, see Viewing your interface endpoint.
For example, in a subnet in which you have an interface endpoint to Elastic Load Balancing and for which you have not enabled the private DNS option, use the following AWS CLI command from an instance to describe your load balancers. The command uses the endpoint-specific Regional DNS hostname to make the request using the interface endpoint.
aws elbv2 describe-load-balancers --endpoint-url https://vpce-0f89a33420c193abc-bluzidnv.elasticloadbalancing.us-east-1.vpce.amazonaws.com/
If you enable the private DNS option, you do not have to specify the endpoint URL
in the request. The AWS CLI uses the default endpoint for the AWS service for the
Region (elasticloadbalancing.us-east-1.amazonaws.com).
Modifying an interface endpoint
You can modify the following attributes of an interface endpoint:
-
The subnet in which the interface endpoint is located
-
The security groups that are associated with the endpoint network interface
-
The tags
-
The private DNS option
Note When you enable private DNS, it might take a few minutes for the private IP addresses to become available.
-
The endpoint policy (if supported by the service)
If you remove a subnet for the interface endpoint, the corresponding endpoint network interface in the subnet is deleted.
