VPC Security: Endpoints, PrivateLink & Network Controls

Overview

VPC endpoints enable private connectivity to AWS services without internet traversal.

VPC Endpoint Types:

Gateway Endpoints:

• Route table entry added pointing to S3/DynamoDB endpoint
• No elastic network interface; no security group
• Endpoint policy can restrict access (e.g., only allow your account's buckets)

Interface Endpoints (PrivateLink):

• Creates an ENI in your subnet with a private IP
• Private DNS: resolves the public service hostname to the private IP (enable Private DNS setting)
• Requires DNS resolution and DNS hostnames enabled in VPC
• Security group attached to the ENI to control access

S3 Bucket Policy Enforcement via VPC Endpoint:

{
  "Effect": "Deny",
  "Action": "s3:*",
  "Condition": {
    "StringNotEquals": {
      "aws:sourceVpce": "vpce-xxxxxxxx"
    }
  }
}

VPC Endpoint Service (PrivateLink for your own services):

• Expose your service (behind NLB) to other VPCs/accounts privately
• Consumer creates an Interface Endpoint pointing to your service
• Traffic stays on AWS backbone; no VPC peering needed
• No IP overlap concern (unlike VPC peering)

PrivateLink vs VPC Peering:

VPC Endpoint Policies:

• Resource-based policies on the endpoint
• Restrict which principals can use the endpoint and what they can do
• Does not replace bucket/resource policies — they work together

Practice Linked Questions