AWS PrivateLink · Private connectivity per service
AWS PrivateLink brings services into your VPC on private IP addresses. Reach AWS services, services in other accounts, and partner SaaS without an internet gateway, NAT, or public IPs, and limit what is reachable to individual services.
Max bandwidth per endpoint, per AZ (scales automatically from 10 Gbps)
VPC endpoint MTU (bytes)
Protocols supported by interface endpoints
IPv4, IPv6, and dualstack endpoints
Why PrivateLink
VPC peering and Transit Gateway open routes between networks. PrivateLink creates only an entry point to a specific service in your VPC; no routes are created to other resources in the other VPC.
Reach services from private subnets without an internet gateway, NAT, or public IPs.
Only the consumer VPC can initiate connections. No path is created from the provider VPC into the consumer VPC.
As long as the consumer and provider are in different VPCs, their IP ranges can overlap, because access goes through an ENI inside the consumer VPC.
Provider & consumer
A PrivateLink connection is completed by work on both sides. The provider puts a service behind a load balancer and publishes it as an endpoint service, and the consumer creates an endpoint in its own VPC to connect to that service.
subnetPick a subnet per AZ to create an interface endpoint. One ENI is created in each AZ.SGAttach security groups to the endpoint ENIs to restrict which clients can connect.DNSWith private DNS enabled, clients reach the endpoint using the existing service name.NLBPut the service behind a Network Load Balancer and create an endpoint service. Appliances use a Gateway Load Balancer.allowSpecify the AWS accounts or IAM principals allowed to connect, and optionally require manual acceptance of requests.regionAdd supported Regions so consumers in other Regions can create endpoints too.Features
Cross-Region
Connect with an interface endpoint to endpoint services and select AWS services (S3, IAM, ECR, and others) in another Region. You don't need to match AZs with the provider, and connections to AWS services can use only the Regional DNS name. PrivateLink manages failover across AZs but not across Regions.
Name resolution
Once the provider verifies and associates a domain name, consumers reach the endpoint with the same name without changing application settings.
Access control
Attach a resource policy to the endpoint to restrict the principals, actions, and resources that can be called through it.
Hybrid
Traffic arriving over Direct Connect, Site-to-Site VPN, Transit Gateway, Cloud WAN, or VPC peering also reaches the endpoint.
VPC Lattice
Reach databases, domain names, or IP targets in other VPCs or on-premises over TCP without a load balancer. The provider shares resources through a resource gateway.
Inspection
Set it as the next hop in a VPC route table to send traffic to a fleet of virtual appliances such as firewalls.
Endpoint types
The endpoint type depends on what you connect to. Gateway endpoints for Amazon S3 and DynamoDB don't use PrivateLink, so they are not included here.
| Type | Connects to | Provider-side setup | How traffic is sent |
|---|---|---|---|
| Interface | AWS services, services from other accounts or partners | Endpoint service backed by an NLB | The DNS name resolves to the ENI private IPs. TCP · UDP |
| Gateway Load Balancer | Fleet of virtual appliances | Endpoint service backed by a GWLB | Set the endpoint as the next hop in a route table. |
| Resource | Databases, EC2 instances, domain names or IP targets | Resource gateway and resource configuration | Access through the endpoint DNS name. TCP |
| Service network | Multiple services and resources associated with a VPC Lattice service network | VPC Lattice service network | One endpoint reaches multiple targets. |
| Tunnel | A shared network segment (CIDR range) | Share a CIDR-range resource configuration through AWS RAM | Encapsulated in GENEVE on UDP 6081. Inner traffic is TCP; UDP is supported only for DNS queries. |
Reference architecture
Even when the consumer and provider VPCs both use 10.0.0.0/16, the interface endpoint connects to the service. On-premises reaches the endpoint through the consumer VPC, and consumers in other Regions use cross-Region PrivateLink.
On narrow screens, swipe the diagram sideways.
Getting started
Create a Network Load Balancer and target group across two or more AZs in the provider VPC.
Select the NLB to create an endpoint service, and add the principals allowed to connect.
The consumer creates an interface endpoint using the service name and picks subnets and security groups.
If acceptance is required, the provider accepts the connection request.
Connect to the service using the endpoint DNS name or the private DNS name.
Pricing
PrivateLink pricing is based on the hours an endpoint is provisioned and the amount of data it processes. The provider-side load balancer and inter-Region transfer are charged separately.
| Component | Billing basis | Notes |
|---|---|---|
| Interface endpoint hours | Hours provisioned in each AZ where the endpoint exists. Partial hours are billed as full hours. | Billed to the consumer that created the endpoint. |
| Interface endpoint data processing | GB processed by the endpoint | Tiered rates apply to the combined volume of all interface endpoints in the Region. |
| Gateway Load Balancer endpoint | Endpoint hours and GB processed | The provider-side Gateway Load Balancer is billed separately at Elastic Load Balancing rates. |
| Resource · Tunnel endpoint | Resource endpoints: hours per resource; tunnel endpoints: endpoint hours. Both: GB processed | Processing tiers are calculated separately from interface endpoints. Service network endpoints themselves have no additional charge; resources and services accessed through the service network follow VPC Lattice pricing. |
| Cross-Region connectivity | Providers: a fixed hourly fee per active remote Region. Consumers: standard endpoint charges plus inter-Region transfer GB | A remote Region is active if at least one interface endpoint is connected from it. Inter-Region transfer is billed to the endpoint owner. |
| Provider Network Load Balancer | NLB hours and NLCUs | Billed separately at Elastic Load Balancing rates. |
Rates vary by Region and usage. See the AWS PrivateLink pricing page for current rates.
Next step
Bring the services to publish, the range of consumer accounts, on-premises access paths, and DNS setup, and we'll review endpoint types and placement together.