Private and Hybrid Connectivity
VPC endpoints and PrivateLink, VPC peering and Transit Gateway, and Site-to-Site plus Client VPN: how traffic reaches AWS services, other VPCs, other networks, and remote users without a public path.
The VPC Fundamentals topic built a network and decided what may enter it. This topic answers a different question: how traffic gets out to somewhere useful without taking a public path. That destination might be an AWS service such as S3, another VPC in your organization, your on-premises data center, or an engineer working from home. Each one has its own service, its own cost profile, and its own way of failing quietly.
What This Topic Covers
- Why a private subnet reaches S3 through a NAT gateway by default, and what that path costs
- Gateway endpoints against interface endpoints: which services, which callers, which price, and which security controls apply to each
- VPC endpoint policies, and why they can produce AccessDenied for a role that IAM allows
- Hosting your own service behind AWS PrivateLink with a Network Load Balancer and an endpoint service
- VPC peering end to end, plus the 3 limits that are properties of the mechanism: no transitive routing, no overlapping CIDRs, no edge to edge routing
- Transit Gateway as a regional router: attachments, route table association against propagation, isolated and shared-services segmentation, and appliance mode
- Site-to-Site VPN anatomy, the 2 tunnels, static against BGP routing, and the TunnelState metric
- Where AWS Direct Connect changes the answer, including why a private line still needs a VPN for encryption
- Client VPN endpoints: client CIDR rules, authentication types, split-tunnel, and the route plus authorization rule pair
Why It Matters
Exam Domain 5 names private connectivity twice: once under building it (Skill 5.1.2, covering VPC endpoints, PrivateLink, and peering) and once under fixing it (Skill 5.3.4, on hybrid and private connectivity issues). The questions rarely ask what a service is. They describe a failure and expect you to know which mechanism could produce it.
That is why the boundaries matter more than the definitions here. A gateway endpoint cannot serve an on-premises caller, peering cannot forward traffic to a third VPC, a Direct Connect line carries no encryption, and a Client VPN route without an authorization rule drops packets. Each of those is a one-sentence rule that eliminates 2 or 3 answer options on sight, and each corresponds to a real production outage that took someone a day to diagnose.