Mastering Private and Public Access for Custom AWS Services

This guide explores the mechanisms for connecting to custom services within AWS, focusing on balancing accessibility with security requirements. We will delve into PrivateLink, VPC Peering, and the architectural choices between public and private exposure.

Learning Objectives

By the end of this guide, you should be able to:

• Distinguish between public and private access methods for AWS services.
• Architect PrivateLink (VPC Endpoint Services) for cross-account service sharing.
• Analyze the trade-offs between VPC Peering and PrivateLink for connectivity.
• Implement secure entry points using Interface Endpoints and Internet Gateways.
• Troubleshoot common connectivity issues related to overlapping IP ranges and routing.

Key Terms & Glossary

• PrivateLink: A technology that provides private connectivity between VPCs, AWS services, and on-premises applications, securely on the Amazon network.
• VPC Endpoint (Interface): An Elastic Network Interface (ENI) with a private IP address from the IP address range of your subnet that serves as an entry point for traffic destined to a supported service.
• VPC Endpoint Service: A service you create in your own VPC to share with other AWS accounts via PrivateLink.
• VPC Peering: A networking connection between two VPCs that enables you to route traffic between them using private IPv4 or IPv6 addresses.
• Internet Gateway (IGW): A horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet.

The "Big Idea"

In AWS, connectivity is a spectrum between reachability and isolation. While public access (IGW, Elastic IPs) provides the easiest path for global users, enterprise-grade architectures favor private access (PrivateLink, Peering) to minimize the attack surface. PrivateLink, specifically, represents a shift from "network-level" connectivity (routing) to "service-level" connectivity (endpoints), allowing services to be shared without the complex routing and security risks associated with traditional peering.

Formula / Concept Box

Hierarchical Outline

• I. Public Access Methods
  • Internet Gateway (IGW): Bi-directional internet traffic for public subnets.
  • Elastic IP (EIP): Static public IPv4 addresses for persistent reachability.
  • Elastic Load Balancer (ELB): Distributes incoming application traffic across multiple targets.
  • API Gateway: Edge service for publishing and managing APIs publicly.
• II. Private Access Methods
  • VPC Peering: Direct L3 connection; acts as one large network.
  • AWS PrivateLink: Securely exposes a specific service (NLB-backed) to other VPCs.
  • VPN/Direct Connect: Hybrid connectivity for on-premises-to-VPC private access.
• III. PrivateLink Deep Dive
  • Provider Side: Service hosted behind a Network Load Balancer (NLB).
  • Consumer Side: Interface VPC Endpoint (ENI) created in the client VPC.

Visual Anchors

PrivateLink Architecture Flow

Logic Flow: Choosing a Connection Method

\begin{center} \begin{tikzpicture}[node distance=2cm, every node/.style={rectangle, draw, fill=white, text centered, minimum height=1em, rounded corners}] \node (start) {Need to connect VPCs?}; \node (overlap) [below of=start] {Overlapping IP addresses?}; \node (full) [below right=1cm and 2cm of overlap] {Full L3 access needed?}; \node (pl) [below left=1cm and 1cm of overlap, fill=blue!10] {Use PrivateLink}; \node (peer) [below of=full, fill=green!10] {Use VPC Peering}; \node (tgw) [right of=full, xshift=2cm, fill=orange!10] {Use Transit Gateway};

\end{tikzpicture} \end{center}

Definition-Example Pairs

• Public Access: Exposing a service to the global internet via a gateway.
  • Example: A retail website hosted on EC2 instances in a public subnet, using an Internet Gateway so customers worldwide can browse products.
• PrivateLink (Interface Endpoint): Accessing an AWS service or custom application using a private IP within your VPC.
  • Example: An internal HR application in VPC-A needs to query a shared Database Service in VPC-B. Instead of peering the whole networks, VPC-A creates an endpoint that connects only to the specific DB service.
• Edge Locations: AWS data centers designed to deliver content with lower latency.
  • Example: Using CloudFront to cache high-resolution videos at an edge location in London so UK-based users don't have to fetch data from an origin server in US-East-1.

Worked Examples

Scenario: Securely Sharing a Custom Analytics Service

The Problem: You have a "Logging Service" in the Services-VPC (CIDR 10.0.0.0/16). You want to share this with 50 customer VPCs. Many customers use the same 10.0.0.0/16 CIDR block for their own VPCs.

The Solution (PrivateLink):

1. Provider Setup: In the Services-VPC, place the logging application behind a Network Load Balancer (NLB).
2. Service Creation: Create a VPC Endpoint Service and associate it with the NLB. Note the Service Name (e.g., com.amazonaws.vpce.us-east-1.vpce-svc-1234).
3. Permissions: Add the AWS Account ARNs of the customers to the "Allow principals" list of the Endpoint Service.
4. Consumer Setup: Customers create an Interface VPC Endpoint using the provided Service Name.
5. Result: The customer gets a private IP (e.g., 10.0.0.55) in their own VPC that directs traffic to the provider's NLB. Since PrivateLink operates at the endpoint level, the identical 10.0.0.0/16 ranges do not conflict.

Checkpoint Questions

1. Does PrivateLink require an Internet Gateway to function? (Answer: No, it stays entirely on the AWS backbone).
2. Which service is better for connecting two VPCs with overlapping CIDR blocks: VPC Peering or PrivateLink? (Answer: PrivateLink).
3. True or False: Traffic initiated from the Service Provider back to the Consumer is supported in PrivateLink. (Answer: False; connections are unidirectional, initiated by the consumer).
4. What type of Load Balancer is required to create a VPC Endpoint Service? (Answer: Network Load Balancer or Gateway Load Balancer).

Muddy Points & Cross-Refs

• Gateway Endpoints vs. Interface Endpoints: This is a common point of confusion. Remember: Gateway Endpoints are only for S3 and DynamoDB (configured via route tables). Interface Endpoints (PrivateLink) are for almost everything else (including S3 now) and use ENIs/DNS names.
• Cost: While VPC Peering is generally free (standard data transfer rates apply), PrivateLink has an hourly charge per endpoint plus data processing fees. For high-volume, internal-only traffic between your own VPCs, Peering might be cheaper if IPs don't overlap.
• Cross-Region: VPC Peering is natively cross-region. PrivateLink also supports cross-region access, but you must create the endpoint in the region where the service resides or use Inter-Region VPC Peering to reach the endpoint.

Comparison Tables

Connectivity Comparison Matrix