AWS PrivateLink and VPC Endpoints

Learn about the AWS PrivateLink and VPC endpoints and types of endpoints.

We'll cover the following

AWS PrivateLink

AWS PrivateLink is a VPC-based service that creates a private connection between VPCs, AWS services, and on-premises resources in an AWS Region. Using PrivateLink, we can connect services in one AWS account, different accounts, and AWS partner-supported services. It uses the AWS private network for communication, so the traffic never goes to the public internet. We don’t need a NAT gateway, IGW, or AWS Direct connection to connect to the resources in a private subnet.

Press + to interact

Here are some key terms you need to know about when referring to the AWS PrivateLink service:

  • Consumer VPC: A VPC in which we want to access a service/application.

  • Service provider VPC/ provider VPC/ VPC endpoint service: A VPC hosted in another AWS account that exposes a service/application to be used by the consumer VPC.

VPC endpoints

VPC endpoints are the resources providing the pathway to access the services. There are three types of VPC endpoints, two of which are powered by AWS PrivateLink. The table below shows their main points:

Interface Endpoint (PrivateLink)

Gateway Endpoint

Gateway Load Balancer Endpoint (PrivateLink)

Uses an elastic network interface with a private IP address.

An endpoint that is used as a target in the route table for the AWS service.

Used to connect and route traffic to the services configured using Gateway Load Balancer.

Works as an entry point to the AWS service, service hosted by another AWS account, or supported AWS partner service.

It doesn’t use IP addresses, PrivateLink, and security groups.

It uses internet gateway to allow the internet traffic to and from the consumer VPC.

It’s a regional resource that can be used only in the region it is created in.

It only supports AWS S3 and AWS DynamoDB and allows IPv4 TCP traffic.

GWLB endpoint is configured in a subnet other than the one where the service consumer application runs within the same VPC.

Allows us to choose a subnet per availability zone, attach a security group, and write an endpoint policy. Attaching a security group is a must; if we don’t specify any security group, then the default one is attached automatically.

Gateway endpoints can only connect VPC and resources in the same region.

All the incoming and outgoing traffic is routed through the GWLB endpoint according to the configurations defined in the route table.

It supports most of the AWS services and allows IPv4 TCP traffic only.

Allows to define endpoint policy.


The cost is attached to it for per hour + per GBs of data processed.

It's free of cost.


VPC peering vs. AWS PrivateLink

Although both of these services connect resources from different VPCs and allow them to communicate with each other, their use cases and purposes of use are quite different. 

  • AWS PrivateLink creates a unidirectional connection between the resources of two VPCs. This means that the consumer VPC clients can only initiate the connection.

  • VPC peering creates a bidirectional connection between the VPCs. This means that the resources from both VPCs can initiate the communication.

  • We need to ensure that the CIDR blocks of IPv4 or IPv6 addresses are not overlapping in VPC peering, AWS PrivateLink uses ENIs, so there is no need to check overlapping.

  • VPC peering is cross-regional, but AWS PrivateLink connects resources within the same Region.

Example: Connecting private EC2 instance to SNS

Consider a scenario with an EC2 instance and Amazon SNS. The EC2 instance is provisioned in a private subnet, and we want to connect the EC2 instance with SNS. We have created a NAT gateway in a public subnet, and an internet gateway is attached to the VPC to access the internet. Let’s see different options to access the SNS using the VPC endpoints (Interface).

  • Option 1: We use NAT and IGW to access Amazon SNS publicly from the private subnet as shown in the gif below:

Press + to interact
Connecting EC2 using NAT and IGW to access SNS
Connecting EC2 using NAT and IGW to access SNS

  • Option 2: We create a VPC endpoint and access Amazon SNS over the AWS private network as shown below:

Press + to interact
Connecting EC2 using VPC endpoint to access SNS
Connecting EC2 using VPC endpoint to access SNS

In option 1, we have to use multiple services (NAT gateway and IGW) to access the Amazon SNS. We can achieve the same in the second option using the VPC endpoint (PrivateLink), and the connection will be private. Also, option 1 is expensive because of the NAT gateway. Therefore, the second option is more suitable and should be adopted.

Important points

Below are a few important points related to AWS PrivateLink and VPC endpoints and they should be kept in mind when working with PrivateLink and endpoints.

  • AWS PrivateLink uses private IP addresses to route traffic.

  • VPC endpoints allow IPv4 TCP traffic only.

  • Almost all AWS services are supported by Interface endpoint (PrivateLink).

  • Gateway endpoint currently supports only Amazon S3 and Amazon DynamoDB.

  • AWS PrivateLink is not cross-regional.

Get hands-on with 1300+ tech skills courses.