Skip to main content
What is AWS PrivateLink, and why use it? Imagine an EC2 instance running in a private subnet that needs to access S3 or another AWS service exposed on a public endpoint. A common approach is to provide internet access for the instance via an Internet Gateway or a NAT Gateway so it can reach the service’s public URL. That works, but it introduces trade-offs:
  • Granting broad internet access increases the instance’s attack surface.
  • Internal resources may be exposed more than necessary.
  • You may want private, tightly controlled connectivity to specific services rather than unrestricted internet access.
PrivateLink addresses these concerns by providing private connectivity between your VPC and supported services so traffic does not traverse the public internet. PrivateLink exposes a supported service to your VPC on private IP addresses. In practice this is implemented as Elastic Network Interfaces (ENIs) in your subnets—these are called interface endpoints. When you create an interface endpoint, the service (whether an AWS service, a partner service, or a service in another VPC) becomes reachable as if it were inside your VPC. Traffic stays on the AWS network, avoids Internet Gateway/NAT, and is limited to the endpoint connection you configure. Note: AWS supports two kinds of VPC endpoints:
  • Interface endpoints (powered by PrivateLink) — used for many AWS services and third-party partner services. They provision ENIs in selected subnets.
  • Gateway endpoints — used specifically for Amazon S3 and DynamoDB; they are implemented differently by adding route table entries.
A diagram illustrating an AWS PrivateLink architecture, showing a Virtual Private Cloud (VPC) with a private subnet connected via endpoints. The endpoints link to AWS services (like S3 and Lambda) and to a third-party VPC.
By using PrivateLink (interface endpoints), third-party or cross-account services can be accessed as if they were hosted in your own VPC. The traffic remains on the AWS global network, does not require an Internet Gateway or NAT Gateway, and is restricted to the specific endpoint connection you configure.

​
VPC endpoint types — quick comparison

  • You need to access AWS services or partner services privately from a private subnet without granting internet access.
  • You want to limit connectivity to a specific service and reduce your attack surface.
  • You need cross-account or cross-VPC access to a service while keeping traffic on the AWS network.

​
Example: create an interface endpoint (AWS CLI)

The following AWS CLI command creates an interface VPC endpoint for a service (replace <vpc-id>, <subnet-ids>, <security-group-ids>, and <service-name> with your values):
After creation, the endpoint provisions ENIs in the specified subnets. DNS within the VPC resolves the service name to the endpoint’s private IP addresses by default.

​
Summary

  • PrivateLink (interface endpoints) lets resources in your VPC connect privately to supported AWS services, partner services, or services hosted in other VPCs without traversing the public internet.
  • Use interface endpoints for most services and third-party integrations; use gateway endpoints specifically for S3 and DynamoDB to leverage route-table-based private access.
A presentation slide titled "Summary" with two numbered points. It explains VPC connectivity: internal resources can connect as if in the same VPC, and it can be used to reach public AWS services (S3, CloudWatch) or other VPCs.
Use interface endpoints (PrivateLink) when you need private, service-specific connectivity to many AWS or third-party services. Use gateway endpoints for Amazon S3 and DynamoDB, which are implemented through route table entries rather than ENIs.

Watch Video