SysPad › Lessons › networking lessons › VPC Endpoint (PrivateLink)

How VPC Endpoint (PrivateLink) works

Reaches a service privately from inside the VPC, keeping traffic off the public internet and off NAT. Three uses: an AWS service, a partner SaaS, or your own service in another VPC or account (the provider publishes an endpoint service behind an NLB, so this replaces VPC peering for one-way, service-scoped access and works even when the two VPC CIDRs overlap). Gateway endpoints (S3, DynamoDB) are free route-table entries; interface endpoints are ENIs billed per AZ-hour and per GB.

Your app sits in a private subnet with no route to the internet, on purpose. So how does it read from S3 or call another team's service without you punching a hole in that wall? A VPC endpoint is a private door: the traffic reaches the service while never leaving the AWS network.

What you will learn

Why is routing AWS-service traffic through a NAT or the internet wasteful and risky?
How does a VPC endpoint keep that traffic inside the AWS network?
How do Gateway and Interface endpoints differ, and when do you use each?
What is PrivateLink, and how does it reach partner SaaS the same way?
When do you reach another VPC with PrivateLink instead of peering or Transit Gateway?

The private-subnet problem

A locked-down subnet has no internet route. To reach a public AWS service endpoint it would otherwise need a NAT gateway and an internet path, which costs NAT data charges and sends your traffic out over the public internet, even if it comes straight back to AWS.

A private door to the service

A VPC endpoint connects your VPC to a service over the AWS network directly. No internet gateway, no NAT, no public IPs. The traffic stays on Amazon's network end to end, which is both cheaper and a smaller attack surface.

⚓ Compliance-driven workloads (healthcare, finance) that must keep data off the public internet, and cost-conscious apps doing heavy S3 or DynamoDB traffic from private subnets.

Two flavours: Gateway and Interface

Gateway endpoints exist only for S3 and DynamoDB. They are a target in your route table, with no hourly cost. Interface endpoints are an ENI (a network card with a private IP) in your subnet, reach most other AWS services, and are billed per hour plus per GB.

PrivateLink: same trick for SaaS

Interface endpoints are powered by AWS PrivateLink. The same mechanism lets you privately reach a partner SaaS, or a service another team in your own company runs in a different VPC or account, as long as they publish an endpoint service. Either way that service appears as a private IP inside your VPC. Private DNS makes the normal public hostname resolve to that private ENI, so app code needs no change.

Reaching another VPC: PrivateLink or peering?

This is the decision people actually get stuck on. Both let VPC A call a service in VPC B, but they share different things. VPC peering and Transit Gateway share a network: routes both ways, and the two CIDR ranges must not overlap. PrivateLink shares a single service: the consumer reaches one endpoint and nothing else, traffic flows one way (consumer to provider), and overlapping CIDRs are fine, because no routing between the networks ever happens.

⚓ A platform team exposing an internal auth or payments API to a dozen product accounts: PrivateLink, so no consumer ever gets a route into the platform VPC.

Flashcards

Why route S3 traffic through a VPC endpoint instead of a NAT gateway?: The endpoint keeps traffic on the AWS network (more private) and skips NAT data charges; the NAT path needlessly goes out to the public internet.
Which services use Gateway endpoints, and what do they cost?: Only S3 and DynamoDB. They are a route-table entry with no hourly charge.
What is an Interface endpoint, physically and money-wise?: An ENI with a private IP in your subnet (PrivateLink-powered), reaching most AWS services and SaaS, billed per hour + per GB.
What does PrivateLink let a SaaS vendor expose to you?: Exactly one service as a private endpoint in your VPC, no peering and no access to the rest of their network.
Another team's VPC uses the same CIDR as yours. How do you call their API?: PrivateLink. It shares one service, not a network, so nothing routes between the VPCs and overlapping CIDRs do not matter. Peering and Transit Gateway both require unique ranges.
How does app code reach a service over an endpoint without changes?: Private DNS resolves the service's normal public hostname to the endpoint's private IP, so existing SDK calls just work.

Sources

Open the SysPad canvas · Official VPC Endpoint (PrivateLink) documentation