[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cheat-sheet---en":3,"domain-info---en":3,"topic-info----en":3,"next-aws-certified-cloudops-engineer-associate-networking-content-delivery-private-and-hybrid-connectivity-vpc-peering-and-transit-gateway-en":4,"prev-aws-certified-cloudops-engineer-associate-networking-content-delivery-private-and-hybrid-connectivity-vpc-peering-and-transit-gateway-en":21,"lesson-aws-certified-cloudops-engineer-associate-networking-content-delivery-private-and-hybrid-connectivity-vpc-peering-and-transit-gateway-en":1266},null,{"locked":5,"reason":6,"meta":7,"item":3},true,"paywall",{"title":8,"description":9,"isFree":10,"estimatedMinutes":11,"difficulty":12,"learningObjectives":13},"Site-to-Site VPN and Client VPN","Two hybrid problems, 2 services: connecting a data center to AWS over IPsec, and connecting individual people to a VPC over TLS. This lesson covers tunnels, static against BGP routing, where Direct Connect changes the answer, and the Client VPN rule that drops traffic even when the route exists.",false,32,"intermediate",[14,15,16,17,18,19,20],"Identify the components of a Site-to-Site VPN connection and explain why every connection has 2 tunnels","Choose between static and BGP routing for a VPN, and predict which route wins when both advertise the same prefix","Compare terminating a VPN on a virtual private gateway against terminating it on a transit gateway","Monitor VPN health with the TunnelState metric and diagnose the common causes of a tunnel that will not come up","Contrast Site-to-Site VPN with Direct Connect, and explain when a scenario calls for both together","Configure a Client VPN endpoint, including client CIDR rules, authentication, split-tunnel, and authorization rules","Diagnose the Client VPN failure where a route exists but traffic is still dropped",{"locked":10,"reason":3,"meta":22,"item":33},{"title":23,"description":24,"isFree":5,"estimatedMinutes":25,"difficulty":12,"learningObjectives":26},"VPC Endpoints and AWS PrivateLink","Two kinds of VPC endpoint keep traffic off the public path to AWS services, and they solve different problems. This lesson separates gateway endpoints from interface endpoints by reach, cost, and failure mode, then covers endpoint policies and hosting your own PrivateLink service.",28,[27,28,29,30,31,32],"Explain why traffic from a private subnet to S3 normally passes through a NAT gateway and what that costs","Compare gateway endpoints and interface endpoints across supported services, routing, DNS, security controls, reach, and price","Choose the correct endpoint type for a scenario involving on-premises callers, peered VPCs, or another Region","Describe what a VPC endpoint policy can and cannot do, and combine it with an IAM or bucket policy","Configure an endpoint service so another account can reach a service you host through AWS PrivateLink","Diagnose the common endpoint failures: private DNS not resolving, a security group blocking the endpoint interface, and an endpoint policy returning AccessDenied",{"id":34,"title":23,"body":35,"description":24,"difficulty":12,"estimatedMinutes":25,"extension":1159,"infographics":1160,"isFree":5,"learningObjectives":1176,"meta":1177,"navigation":5,"path":1178,"quiz":1179,"seo":1263,"stem":1264,"__hash__":1265},"courses/courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/02-private-and-hybrid-connectivity/01-vpc-endpoints-and-privatelink.md",{"type":36,"value":37,"toc":1148},"minimark",[38,47,50,55,67,74,81,85,92,95,128,134,137,143,156,162,169,232,239,243,250,253,274,277,285,296,311,314,318,321,443,448,455,462,466,473,595,610,625,839,842,870,874,877,896,918,925,928,935,939,942,948,962,1006,1012,1021,1027,1033,1037,1091,1095,1141,1144],[39,40,41,42,46],"p",{},"An instance in a private subnet uploads 40 TB a month to an S3 bucket in the same Region. The route table sends ",[43,44,45],"code",{},"0.0.0.0/0"," to a NAT gateway, so every one of those gigabytes is metered by the NAT gateway's data processing charge on the way out. The data never touches the public internet: it goes out through the internet gateway and stays on the AWS network the whole way. You are paying a translation device to forward traffic between 2 AWS services.",[39,48,49],{},"There is a route table entry that removes the NAT gateway from that path entirely, and it costs nothing. There is also a second kind of endpoint that costs money and does something the first one cannot do at all. Knowing which is which is most of this lesson.",[51,52,54],"h2",{"id":53},"why-the-traffic-leaves-your-vpc-in-the-first-place","Why the traffic leaves your VPC in the first place",[39,56,57,58,62,63,66],{},"S3, DynamoDB, CloudWatch, and the rest of the AWS API surface are reached through ",[59,60,61],"strong",{},"public service endpoints",": regional DNS names like ",[43,64,65],{},"s3.us-east-1.amazonaws.com"," that resolve to public IP addresses. Your instance is not talking to something inside your VPC, so the packet needs a way out, and by definition a private subnet has no route to an internet gateway. That is why the NAT gateway is there.",[39,68,69,70,73],{},"Worth being precise about one thing, because it changes how you argue about this with a security team: traffic to an AWS service through an internet gateway ",[59,71,72],{},"does not leave the AWS network",". AWS says so directly. The reason to build a VPC endpoint is not usually \"the data is exposed on the internet\". The reasons are that a private subnet should not need an internet path at all, that you want to pin access to a specific endpoint in a policy, and that NAT gateway data processing on high-volume traffic is money spent on nothing.",[39,75,76,77,80],{},"A ",[59,78,79],{},"VPC endpoint"," is the fix. It connects your VPC to a service without an internet gateway or a NAT device in the path. There are 2 shapes of it, and they are built on different mechanisms.",[51,82,84],{"id":83},"gateway-endpoints-a-route-not-an-address","Gateway endpoints: a route, not an address",[39,86,87,88,91],{},"A gateway endpoint serves exactly 2 services: ",[59,89,90],{},"Amazon S3 and DynamoDB",". Nothing else. It is not built on PrivateLink, unlike every other endpoint type, and it is free.",[39,93,94],{},"When you create one, you select the route tables that should use it. AWS then adds this route to each selected table:",[96,97,98,111],"table",{},[99,100,101],"thead",{},[102,103,104,108],"tr",{},[105,106,107],"th",{},"Destination",[105,109,110],{},"Target",[112,113,114],"tbody",{},[102,115,116,123],{},[117,118,119,122],"td",{},[43,120,121],{},"pl-63a5400a"," (the AWS-managed prefix list for the service)",[117,124,125],{},[43,126,127],{},"vpce-0a1b2c3d4e5f67890",[39,129,130,131,133],{},"You can look at that route but you cannot edit or delete it. It is removed when you disassociate the route table or delete the endpoint. That is the entire mechanism: a more specific route that beats ",[43,132,45],{},".",[39,135,136],{},"Three consequences follow directly, and each shows up in scenarios:",[39,138,139,142],{},[59,140,141],{},"Association is by route table, not by VPC."," Instances in subnets whose route tables you associated use the endpoint. Instances in other subnets keep using the public service endpoint through whatever path they had. A \"some instances work, some do not\" report about S3 access is usually a route table that was never associated.",[39,144,145,148,149,151,152,155],{},[59,146,147],{},"Longest prefix match decides everything."," The prefix list is more specific than ",[43,150,45],{},", so same-Region S3 traffic goes to the endpoint while traffic to any other AWS service still goes to the internet gateway. Prefix lists are per-Region, so traffic to S3 in a ",[59,153,154],{},"different"," Region falls back to the internet gateway. If someone adds a route with the exact service IP range and a different target, that route wins over the endpoint route.",[39,157,158,161],{},[59,159,160],{},"One endpoint route per service per route table."," A single route table can hold an S3 endpoint route and a DynamoDB endpoint route, and you can point several route tables at the same endpoint. You cannot put 2 S3 endpoint routes in one table.",[39,163,164,165,168],{},"Security is where gateway endpoints surprise people. Your instances still reach the service ",[59,166,167],{},"at its public IP addresses",", so the controls that apply are the ones that filter by address:",[170,171,176],"pre",{"className":172,"code":173,"language":174,"meta":175,"style":175},"language-bash shiki shiki-themes material-theme-lighter github-light github-dark","# Outbound security group rule for instances using a gateway endpoint.\n# The source is a prefix list ID, not a CIDR.\naws ec2 authorize-security-group-egress \\\n  --group-id sg-0app11111111111111 \\\n  --ip-permissions IpProtocol=tcp,FromPort=443,ToPort=443,PrefixListIds=[{PrefixListId=pl-63a5400a}]\n","bash","",[43,177,178,187,193,211,223],{"__ignoreMap":175},[179,180,183],"span",{"class":181,"line":182},"line",1,[179,184,186],{"class":185},"sutJx","# Outbound security group rule for instances using a gateway endpoint.\n",[179,188,190],{"class":181,"line":189},2,[179,191,192],{"class":185},"# The source is a prefix list ID, not a CIDR.\n",[179,194,196,200,204,207],{"class":181,"line":195},3,[179,197,199],{"class":198},"sbgvK","aws",[179,201,203],{"class":202},"s_sjI"," ec2",[179,205,206],{"class":202}," authorize-security-group-egress",[179,208,210],{"class":209},"s_hVV"," \\\n",[179,212,214,218,221],{"class":181,"line":213},4,[179,215,217],{"class":216},"stzsN","  --group-id",[179,219,220],{"class":202}," sg-0app11111111111111",[179,222,210],{"class":209},[179,224,226,229],{"class":181,"line":225},5,[179,227,228],{"class":216},"  --ip-permissions",[179,230,231],{"class":202}," IpProtocol=tcp,FromPort=443,ToPort=443,PrefixListIds=[{PrefixListId=pl-63a5400a}]\n",[39,233,234,235,238],{},"Network ACLs cannot reference a prefix list, so if the subnet has a restrictive network ACL you have to read the service CIDR blocks out of the prefix list and write them as rules. There is no security group ",[59,236,237],{},"on"," a gateway endpoint, because a gateway endpoint has no network interface to attach one to.",[51,240,242],{"id":241},"interface-endpoints-a-private-address-in-your-subnet","Interface endpoints: a private address in your subnet",[39,244,245,246,249],{},"An interface endpoint is a different object. For each subnet you select, AWS creates an ",[59,247,248],{},"endpoint network interface"," in that subnet and gives it a private IP address from the subnet range. That interface is requester-managed: you can see it, you cannot manage it, and its IP address does not change for the lifetime of the endpoint. You pick one subnet per Availability Zone, never 2 in the same zone.",[39,251,252],{},"Because it is a real network interface with a real private address, the things you would expect to work do work:",[254,255,256,264,267],"ul",{},[257,258,259,260,263],"li",{},"It carries ",[59,261,262],{},"security groups",", and those rules control which resources in your VPC may talk to it. Forget to allow inbound 443 from your application's security group and every SDK call hangs.",[257,265,266],{},"Its address is reachable from anywhere that can route to your subnet: a peered VPC, a transit gateway, a Site-to-Site VPN, a Direct Connect connection.",[257,268,269,270,273],{},"It is billed. You pay an hourly charge for the endpoint in ",[59,271,272],{},"each Availability Zone"," where it is provisioned, plus a charge per GB processed.",[39,275,276],{},"The service is reached over DNS. Creating the endpoint gives you a regional name and one zonal name per zone:",[170,278,283],{"className":279,"code":281,"language":282},[280],"language-text","vpce-099deb00b40f00e22.monitoring.us-east-2.vpce.amazonaws.com\nvpce-099deb00b40f00e22-us-east-2a.monitoring.us-east-2.vpce.amazonaws.com\n","text",[43,284,281],{"__ignoreMap":175},[39,286,287,288,291,292,295],{},"Nobody wants to rewrite every SDK client to use those. That is what ",[59,289,290],{},"private DNS"," is for. Enable it and AWS creates a hidden, AWS-managed private hosted zone containing a record for the service's normal public name, pointing at the private IP addresses of your endpoint interfaces. Your existing code calling ",[43,293,294],{},"monitoring.us-east-2.amazonaws.com"," now reaches the endpoint with no change at all.",[39,297,298,299,302,303,306,307,310],{},"Private DNS has one hard prerequisite that generates a steady stream of tickets: the VPC must have ",[59,300,301],{},"both"," ",[43,304,305],{},"enableDnsSupport"," and ",[43,308,309],{},"enableDnsHostnames"," turned on. Without them the option does nothing visible. And because the record lives in a private hosted zone served by the Route 53 Resolver, it works only inside the VPC. On-premises callers either use the endpoint-specific DNS names, which resolve publicly to the private addresses, or reach the Route 53 Resolver through an inbound Resolver endpoint.",[39,312,313],{},"Availability follows from where you put the interfaces. If you enable a single Availability Zone, the regional name resolves to that one interface for the entire VPC, including instances in other zones. That works fine right up until the zone holding the interface is impaired, and then the whole VPC loses the service. AWS recommends at least 2 zones per endpoint, and with more than one healthy interface it alternates between them round robin.",[51,315,317],{"id":316},"the-boundary-that-decides-most-questions","The boundary that decides most questions",[39,319,320],{},"Both endpoint types keep traffic on the AWS network. They differ on who can use them and what they cost.",[96,322,323,335],{},[99,324,325],{},[102,326,327,329,332],{},[105,328],{},[105,330,331],{},"Gateway endpoint",[105,333,334],{},"Interface endpoint",[112,336,337,348,359,370,381,392,403,412,422,433],{},[102,338,339,342,345],{},[117,340,341],{},"Services",[117,343,344],{},"S3 and DynamoDB only",[117,346,347],{},"Most AWS services, plus PrivateLink services from partners and other accounts",[102,349,350,353,356],{},[117,351,352],{},"Mechanism",[117,354,355],{},"Route table entry to a prefix list",[117,357,358],{},"Elastic network interface with a private IP per subnet",[102,360,361,364,367],{},[117,362,363],{},"Addressing",[117,365,366],{},"Instances use the service's public IP addresses",[117,368,369],{},"Instances use private IP addresses in your VPC",[102,371,372,375,378],{},[117,373,374],{},"DNS",[117,376,377],{},"Unchanged service DNS names",[117,379,380],{},"Endpoint-specific names, or the public name through private DNS",[102,382,383,386,389],{},[117,384,385],{},"Security control",[117,387,388],{},"Security group rules referencing the prefix list, network ACL rules by CIDR",[117,390,391],{},"Security groups on the endpoint interfaces",[102,393,394,397,400],{},[117,395,396],{},"From on-premises over VPN or Direct Connect",[117,398,399],{},"Not possible",[117,401,402],{},"Yes",[102,404,405,408,410],{},[117,406,407],{},"From a peered VPC or across a transit gateway",[117,409,399],{},[117,411,402],{},[102,413,414,417,419],{},[117,415,416],{},"From another Region",[117,418,399],{},[117,420,421],{},"Yes, through peering or Transit Gateway, and cross-Region endpoints are supported for some services",[102,423,424,427,430],{},[117,425,426],{},"Price",[117,428,429],{},"Free",[117,431,432],{},"Hourly per Availability Zone plus per GB processed",[102,434,435,438,441],{},[117,436,437],{},"Built on PrivateLink",[117,439,440],{},"No",[117,442,402],{},[444,445],"infographic",{"alt":446,"slug":447},"A gateway endpoint serves only callers inside the VPC, while an interface endpoint with a private IP address also serves peered VPCs and on-premises networks.","endpoint-reach-gateway-vs-interface",[39,449,450,451,454],{},"The single question that separates them in a scenario is ",[59,452,453],{},"where the caller sits",". Inside this VPC, and the destination is S3 or DynamoDB? A gateway endpoint is the cheap answer. Anywhere else, or any other service? Interface endpoint.",[39,456,457,458,461],{},"They are not exclusive, and AWS documents the combination as a cost pattern for S3: keep the gateway endpoint so in-VPC traffic stays free, add an interface endpoint so on-premises applications can reach S3 privately, and point the on-premises clients at the endpoint-specific DNS names. The console does this for you with the ",[59,459,460],{},"Enable private DNS only for inbound endpoint"," option, which routes only the queries arriving through an inbound Resolver endpoint to the interface endpoint and leaves in-VPC traffic on the free gateway path. Selecting it requires that a gateway endpoint already exist in the VPC, and you cannot delete that gateway endpoint while the option is on.",[51,463,465],{"id":464},"endpoint-policies-a-gate-not-a-grant","Endpoint policies: a gate, not a grant",[39,467,468,469,472],{},"Every endpoint for an AWS service can carry an ",[59,470,471],{},"endpoint policy",": an IAM-language resource policy attached to the endpoint that decides which principals and actions may pass through it. If you do not attach one, AWS attaches the default, which allows everything:",[170,474,478],{"className":475,"code":476,"language":477,"meta":175,"style":175},"language-json shiki shiki-themes material-theme-lighter github-light github-dark","{\n  \"Statement\": [\n    { \"Effect\": \"Allow\", \"Principal\": \"*\", \"Action\": \"*\", \"Resource\": \"*\" }\n  ]\n}\n","json",[43,479,480,486,505,585,590],{"__ignoreMap":175},[179,481,482],{"class":181,"line":182},[179,483,485],{"class":484},"sP7_E","{\n",[179,487,488,492,496,499,502],{"class":181,"line":189},[179,489,491],{"class":490},"s39Yj","  \"",[179,493,495],{"class":494},"sseR_","Statement",[179,497,498],{"class":490},"\"",[179,500,501],{"class":484},":",[179,503,504],{"class":484}," [\n",[179,506,507,510,513,517,519,521,524,527,529,532,534,537,539,541,543,546,548,550,552,555,557,559,561,563,565,567,569,572,574,576,578,580,582],{"class":181,"line":195},[179,508,509],{"class":484},"    {",[179,511,512],{"class":490}," \"",[179,514,516],{"class":515},"sZMiF","Effect",[179,518,498],{"class":490},[179,520,501],{"class":484},[179,522,512],{"class":523},"sjJ54",[179,525,526],{"class":202},"Allow",[179,528,498],{"class":523},[179,530,531],{"class":484},",",[179,533,512],{"class":490},[179,535,536],{"class":515},"Principal",[179,538,498],{"class":490},[179,540,501],{"class":484},[179,542,512],{"class":523},[179,544,545],{"class":202},"*",[179,547,498],{"class":523},[179,549,531],{"class":484},[179,551,512],{"class":490},[179,553,554],{"class":515},"Action",[179,556,498],{"class":490},[179,558,501],{"class":484},[179,560,512],{"class":523},[179,562,545],{"class":202},[179,564,498],{"class":523},[179,566,531],{"class":484},[179,568,512],{"class":490},[179,570,571],{"class":515},"Resource",[179,573,498],{"class":490},[179,575,501],{"class":484},[179,577,512],{"class":523},[179,579,545],{"class":202},[179,581,498],{"class":523},[179,583,584],{"class":484}," }\n",[179,586,587],{"class":181,"line":213},[179,588,589],{"class":484},"  ]\n",[179,591,592],{"class":181,"line":225},[179,593,594],{"class":484},"}\n",[39,596,597,598,601,602,605,606,609],{},"The mental model that keeps people out of trouble: an endpoint policy is a ",[59,599,600],{},"filter on the pipe",", not a source of permission. It never overrides or replaces an identity-based policy or a resource-based policy. A request that crosses the endpoint needs a yes from the IAM policy on the caller, a yes from any resource policy such as an S3 bucket policy, and a yes from the endpoint policy. Replace the default with a narrow policy and you can produce ",[43,603,604],{},"AccessDenied"," for a role that has ",[43,607,608],{},"AmazonS3FullAccess",", which is exactly the confusing ticket this design creates.",[39,611,612,613,616,617,620,621,624],{},"A useful pairing goes the other way as well. The endpoint policy limits which buckets can be reached ",[59,614,615],{},"through the endpoint","; a bucket policy with an ",[43,618,619],{},"aws:sourceVpce"," condition limits which endpoints can reach ",[59,622,623],{},"the bucket",". Use both and the bucket is only reachable from your network, and your network can only reach that bucket:",[170,626,628],{"className":475,"code":627,"language":477,"meta":175,"style":175},"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [{\n    \"Sid\": \"Access-to-specific-VPCE-only\",\n    \"Principal\": \"*\",\n    \"Action\": \"s3:*\",\n    \"Effect\": \"Deny\",\n    \"Resource\": [\"arn:aws:s3:::finance-reports\", \"arn:aws:s3:::finance-reports/*\"],\n    \"Condition\": { \"StringNotEquals\": { \"aws:sourceVpce\": \"vpce-1a2b3c4d\" } }\n  }]\n}\n",[43,629,630,634,655,668,689,707,727,747,780,828,834],{"__ignoreMap":175},[179,631,632],{"class":181,"line":182},[179,633,485],{"class":484},[179,635,636,638,641,643,645,647,650,652],{"class":181,"line":189},[179,637,491],{"class":490},[179,639,640],{"class":494},"Version",[179,642,498],{"class":490},[179,644,501],{"class":484},[179,646,512],{"class":523},[179,648,649],{"class":202},"2012-10-17",[179,651,498],{"class":523},[179,653,654],{"class":484},",\n",[179,656,657,659,661,663,665],{"class":181,"line":195},[179,658,491],{"class":490},[179,660,495],{"class":494},[179,662,498],{"class":490},[179,664,501],{"class":484},[179,666,667],{"class":484}," [{\n",[179,669,670,673,676,678,680,682,685,687],{"class":181,"line":213},[179,671,672],{"class":490},"    \"",[179,674,675],{"class":515},"Sid",[179,677,498],{"class":490},[179,679,501],{"class":484},[179,681,512],{"class":523},[179,683,684],{"class":202},"Access-to-specific-VPCE-only",[179,686,498],{"class":523},[179,688,654],{"class":484},[179,690,691,693,695,697,699,701,703,705],{"class":181,"line":225},[179,692,672],{"class":490},[179,694,536],{"class":515},[179,696,498],{"class":490},[179,698,501],{"class":484},[179,700,512],{"class":523},[179,702,545],{"class":202},[179,704,498],{"class":523},[179,706,654],{"class":484},[179,708,710,712,714,716,718,720,723,725],{"class":181,"line":709},6,[179,711,672],{"class":490},[179,713,554],{"class":515},[179,715,498],{"class":490},[179,717,501],{"class":484},[179,719,512],{"class":523},[179,721,722],{"class":202},"s3:*",[179,724,498],{"class":523},[179,726,654],{"class":484},[179,728,730,732,734,736,738,740,743,745],{"class":181,"line":729},7,[179,731,672],{"class":490},[179,733,516],{"class":515},[179,735,498],{"class":490},[179,737,501],{"class":484},[179,739,512],{"class":523},[179,741,742],{"class":202},"Deny",[179,744,498],{"class":523},[179,746,654],{"class":484},[179,748,750,752,754,756,758,761,763,766,768,770,772,775,777],{"class":181,"line":749},8,[179,751,672],{"class":490},[179,753,571],{"class":515},[179,755,498],{"class":490},[179,757,501],{"class":484},[179,759,760],{"class":484}," [",[179,762,498],{"class":523},[179,764,765],{"class":202},"arn:aws:s3:::finance-reports",[179,767,498],{"class":523},[179,769,531],{"class":484},[179,771,512],{"class":523},[179,773,774],{"class":202},"arn:aws:s3:::finance-reports/*",[179,776,498],{"class":523},[179,778,779],{"class":484},"],\n",[179,781,783,785,788,790,792,795,797,801,803,805,807,809,812,814,816,818,821,823,826],{"class":181,"line":782},9,[179,784,672],{"class":490},[179,786,787],{"class":515},"Condition",[179,789,498],{"class":490},[179,791,501],{"class":484},[179,793,794],{"class":484}," {",[179,796,512],{"class":490},[179,798,800],{"class":799},"srdBf","StringNotEquals",[179,802,498],{"class":490},[179,804,501],{"class":484},[179,806,794],{"class":484},[179,808,512],{"class":490},[179,810,619],{"class":811},"swQdS",[179,813,498],{"class":490},[179,815,501],{"class":484},[179,817,512],{"class":523},[179,819,820],{"class":202},"vpce-1a2b3c4d",[179,822,498],{"class":523},[179,824,825],{"class":484}," }",[179,827,584],{"class":484},[179,829,831],{"class":181,"line":830},10,[179,832,833],{"class":484},"  }]\n",[179,835,837],{"class":181,"line":836},11,[179,838,594],{"class":484},[39,840,841],{},"Details that bite in practice:",[254,843,844,861,864,867],{},[257,845,846,847,849,850,853,854,856,857,860],{},"The policy must contain a ",[43,848,536],{}," element. For ",[59,851,852],{},"gateway"," endpoints that element must be ",[43,855,545],{},", and you narrow the principal with an ",[43,858,859],{},"aws:PrincipalArn"," condition instead.",[257,862,863],{},"Maximum size is 20,480 characters including whitespace.",[257,865,866],{},"Not every AWS service supports endpoint policies. Where a service does not, full access is allowed through the endpoint and nothing you write changes that.",[257,868,869],{},"Changes take a few minutes to take effect, so a test immediately after saving can mislead you in either direction.",[51,871,873],{"id":872},"privatelink-for-a-service-you-own","PrivateLink for a service you own",[39,875,876],{},"Everything so far consumed an AWS service. PrivateLink also runs in the other direction: you can publish a service from your VPC and let other accounts consume it as an interface endpoint, with no peering, no shared address space, and no route between the 2 VPCs.",[39,878,879,880,883,884,887,888,891,892,895],{},"As the ",[59,881,882],{},"service provider"," you put a ",[59,885,886],{},"Network Load Balancer"," in front of your service, then create an ",[59,889,890],{},"endpoint service"," configuration that points at that load balancer. By default nobody can connect: you add permissions naming the specific AWS principals allowed to request a connection. AWS generates a service name like ",[43,893,894],{},"com.amazonaws.vpce.us-east-2.vpce-svc-071afff70666e61e0"," that you share with consumers.",[39,897,879,898,901,902,905,906,909,910,913,914,917],{},[59,899,900],{},"consumer",", you create an interface endpoint for that service name. The connection request lands on the provider, who accepts or rejects it, either manually or automatically. The endpoint becomes usable when it reaches the ",[43,903,904],{},"available"," state, and the possible states are worth recognizing in a troubleshooting question: ",[43,907,908],{},"pendingAcceptance"," means the provider has not acted yet, ",[43,911,912],{},"rejected"," means they refused, ",[43,915,916],{},"expired"," means the request timed out.",[39,919,920,921,924],{},"Two things make this pattern work at scale where peering does not. The 2 VPCs never exchange routes, so ",[59,922,923],{},"overlapping CIDR blocks do not matter",". And the connection is one-directional by construction: the consumer initiates, and the service cannot open connections back through the endpoint.",[39,926,927],{},"For high availability the provider enables the load balancer in at least 2 Availability Zones, since the endpoint service is only available in zones the load balancer is enabled in. Cross-zone load balancing is an alternative, with the caveat that a zone failure then takes out access from both zones, plus EC2 data transfer charges.",[39,929,930,931,934],{},"If the provider associates a ",[59,932,933],{},"private DNS name"," with the endpoint service and verifies domain ownership, consumers can keep calling the service by its existing name. Without that, consumers change their applications to use the endpoint DNS name.",[51,936,938],{"id":937},"when-it-does-not-work","When it does not work",[39,940,941],{},"Endpoint failures cluster into a small number of causes. Walk them in this order:",[39,943,944,947],{},[59,945,946],{},"The security group on the endpoint interface."," Interface endpoints get the VPC's default security group unless you pick another, and the default allows inbound only from resources in the same group. If your application instances are in a different security group, every call to the endpoint hangs until you add an inbound rule allowing 443 from them.",[39,949,950,953,954,957,958,961],{},[59,951,952],{},"Ping proves nothing."," Interface endpoints do not respond to ICMP echo requests. AWS says to use ",[43,955,956],{},"nc"," or ",[43,959,960],{},"nmap"," instead. Rebuilding a healthy endpoint because ping failed is a real and avoidable outage.",[170,963,965],{"className":172,"code":964,"language":174,"meta":175,"style":175},"# Does the endpoint answer on the service port?\nnc -zv vpce-099deb00b40f00e22.monitoring.us-east-2.vpce.amazonaws.com 443\n\n# What is the service name actually resolving to?\ndig +short monitoring.us-east-2.amazonaws.com\n",[43,966,967,972,985,990,995],{"__ignoreMap":175},[179,968,969],{"class":181,"line":182},[179,970,971],{"class":185},"# Does the endpoint answer on the service port?\n",[179,973,974,976,979,982],{"class":181,"line":189},[179,975,956],{"class":198},[179,977,978],{"class":216}," -zv",[179,980,981],{"class":202}," vpce-099deb00b40f00e22.monitoring.us-east-2.vpce.amazonaws.com",[179,983,984],{"class":799}," 443\n",[179,986,987],{"class":181,"line":195},[179,988,989],{"emptyLinePlaceholder":5},"\n",[179,991,992],{"class":181,"line":213},[179,993,994],{"class":185},"# What is the service name actually resolving to?\n",[179,996,997,1000,1003],{"class":181,"line":225},[179,998,999],{"class":198},"dig",[179,1001,1002],{"class":202}," +short",[179,1004,1005],{"class":202}," monitoring.us-east-2.amazonaws.com\n",[39,1007,1008,1009,1011],{},"If that ",[43,1010,999],{}," returns public addresses, private DNS is either off or the VPC is missing the DNS attributes.",[39,1013,1014,1017,1018,1020],{},[59,1015,1016],{},"The endpoint policy."," An ",[43,1019,604],{}," that survives a correct IAM policy, and that only happens for calls from inside the VPC, points at the endpoint policy every time.",[39,1022,1023,1026],{},[59,1024,1025],{},"The wrong endpoint type."," On-premises callers, peered VPCs, and other Regions cannot use a gateway endpoint. This is not a configuration you can fix; it is a property of the mechanism.",[39,1028,1029,1032],{},[59,1030,1031],{},"Network ACLs."," Traffic between your resources and the endpoint interfaces still crosses the subnet boundary. A restrictive network ACL needs rules in both directions, including the ephemeral port range for return traffic.",[51,1034,1036],{"id":1035},"quotas-worth-remembering","Quotas worth remembering",[96,1038,1039,1049],{},[99,1040,1041],{},[102,1042,1043,1046],{},[105,1044,1045],{},"Limit",[105,1047,1048],{},"Value",[112,1050,1051,1059,1067,1075,1083],{},[102,1052,1053,1056],{},[117,1054,1055],{},"Interface and Gateway Load Balancer endpoints per VPC",[117,1057,1058],{},"50 (adjustable)",[102,1060,1061,1064],{},[117,1062,1063],{},"Gateway endpoints per Region",[117,1065,1066],{},"20 (adjustable), up to 255 per VPC",[102,1068,1069,1072],{},[117,1070,1071],{},"Characters per endpoint policy",[117,1073,1074],{},"20,480, not adjustable",[102,1076,1077,1080],{},[117,1078,1079],{},"Bandwidth per endpoint per Availability Zone",[117,1081,1082],{},"10 Gbps, scaling automatically to 100 Gbps",[102,1084,1085,1088],{},[117,1086,1087],{},"MTU through a VPC endpoint",[117,1089,1090],{},"8500 bytes; larger packets are dropped, and Path MTU Discovery is not supported",[51,1092,1094],{"id":1093},"exam-tips","Exam tips",[254,1096,1097,1100,1103,1114,1117,1126,1129,1135,1138],{},[257,1098,1099],{},"\"S3 or DynamoDB, from inside the VPC, at no extra cost\" is a gateway endpoint. Any other service, or any caller outside the VPC, is an interface endpoint.",[257,1101,1102],{},"The phrase \"from our on-premises data center\" or \"from the peered VPC\" rules out gateway endpoints entirely. That is the fastest elimination in this topic.",[257,1104,1105,1106,1109,1110,1113],{},"Gateway endpoint means a ",[59,1107,1108],{},"route table entry",". Interface endpoint means an ",[59,1111,1112],{},"ENI with a private IP",". Every other difference follows from that one sentence.",[257,1115,1116],{},"Only interface endpoints carry security groups. A question about restricting which instances may use an endpoint is an interface endpoint question.",[257,1118,1119,1120,1122,1123,1125],{},"An endpoint policy never grants permission. When a scenario shows ",[43,1121,604],{}," despite an over-broad IAM policy, look for the endpoint policy or a bucket policy ",[43,1124,619],{}," condition.",[257,1127,1128],{},"Private DNS requires DNS hostnames and DNS resolution enabled on the VPC. This is the answer whenever \"we enabled private DNS but nothing changed\".",[257,1130,1131,1132,1134],{},"Hosting your own PrivateLink service needs a ",[59,1133,886],{}," plus explicit principal permissions. Gateway Load Balancer endpoints are for routing traffic to inspection appliances, which is a different job.",[257,1136,1137],{},"One subnet per Availability Zone for an interface endpoint, and at least 2 zones in production or you have built a single-zone dependency for the whole VPC.",[257,1139,1140],{},"Interface endpoints do not answer ping.",[39,1142,1143],{},"The decision rule to carry forward is short: if the caller is inside this VPC and the destination is S3 or DynamoDB, take the free route; otherwise pay for a private address. The next lesson keeps the same goal of private traffic but changes the destination from an AWS service to another network, where the question stops being \"which endpoint\" and becomes \"how many connections am I willing to manage\".",[1145,1146,1147],"style",{},"html pre.shiki code .sutJx, html code.shiki .sutJx{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#6A737D;--shiki-default-font-style:inherit;--shiki-dark:#6A737D;--shiki-dark-font-style:inherit}html pre.shiki code .sbgvK, html code.shiki .sbgvK{--shiki-light:#E2931D;--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .s_hVV, html code.shiki .s_hVV{--shiki-light:#90A4AE;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .stzsN, html code.shiki .stzsN{--shiki-light:#91B859;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sP7_E, html code.shiki .sP7_E{--shiki-light:#39ADB5;--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .s39Yj, html code.shiki .s39Yj{--shiki-light:#39ADB5;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sseR_, html code.shiki .sseR_{--shiki-light:#9C3EDA;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZMiF, html code.shiki .sZMiF{--shiki-light:#E2931D;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sjJ54, html code.shiki .sjJ54{--shiki-light:#39ADB5;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .srdBf, html code.shiki .srdBf{--shiki-light:#F76D47;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .swQdS, html code.shiki .swQdS{--shiki-light:#E53935;--shiki-default:#005CC5;--shiki-dark:#79B8FF}",{"title":175,"searchDepth":195,"depth":195,"links":1149},[1150,1151,1152,1153,1154,1155,1156,1157,1158],{"id":53,"depth":189,"text":54},{"id":83,"depth":189,"text":84},{"id":241,"depth":189,"text":242},{"id":316,"depth":189,"text":317},{"id":464,"depth":189,"text":465},{"id":872,"depth":189,"text":873},{"id":937,"depth":189,"text":938},{"id":1035,"depth":189,"text":1036},{"id":1093,"depth":189,"text":1094},"md",[1161],{"slug":447,"concept":1162,"style":1163,"aspectRatio":1164,"labels":1165},"A 2-panel comparison built around who can reach the endpoint. Each panel shows the same 3 callers stacked on the left (an instance in the VPC, an instance in a peered VPC, an on-premises server over Direct Connect or VPN) with arrows toward an endpoint box and then to the AWS service. In the gateway panel, only the in-VPC arrow connects and the other 2 arrows are cut with a block marker at the VPC boundary. In the interface panel all 3 arrows connect to an endpoint network interface drawn inside a subnet. A footer strip carries the cost difference. The emphasis is the 2 blocked arrows, because that single asymmetry decides most scenario questions.","comparison","16:9",[1166,1167,1168,1169,1170,1171,1172,1173,1174,1175],"Gateway endpoint: a route table entry, S3 and DynamoDB only","Interface endpoint: an ENI with a private IP in your subnet","Instance in this VPC: works with both","Instance in a peered VPC: blocked by a gateway endpoint","On-premises over Direct Connect or VPN: blocked by a gateway endpoint","Route destination: AWS-managed prefix list, target: the gateway endpoint","Endpoint network interface: private IP, security group, private DNS","No charge for the gateway endpoint","Interface endpoint: hourly charge per Availability Zone plus a charge per GB processed","If the caller is outside the VPC, the answer is an interface endpoint",[27,28,29,30,31,32],{},"/courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/02-private-and-hybrid-connectivity/01-vpc-endpoints-and-privatelink",{"passingScore":1180,"questions":1181},70,[1182,1191,1199,1207,1215,1225,1233,1241,1249,1255],{"question":1183,"type":1184,"options":1185,"correctAnswer":1188,"explanation":1190},"Your EC2 instances in private subnets write 40 TB per month to an S3 bucket in the same Region, and the traffic currently goes out through a NAT gateway. Which change removes the data processing charge for that traffic at no additional cost?","single",[1186,1187,1188,1189],"Move the instances into public subnets with Elastic IP addresses","Create an interface endpoint for S3 in each Availability Zone","Create a gateway endpoint for S3 and associate the private subnets' route tables with it","Enable S3 Transfer Acceleration on the bucket","A gateway endpoint carries no charge at all and takes the S3 traffic off the NAT gateway path, so the per-GB NAT data processing charge disappears. An interface endpoint would also work but is billed per hour and per GB, so it does not meet the no-additional-cost requirement. Moving instances to public subnets solves the cost problem by giving them public addresses, which is a security regression, not a fix.",{"question":1192,"type":1184,"options":1193,"correctAnswer":1195,"explanation":1198},"An application in your on-premises data center connects through Direct Connect and needs to reach Amazon S3 over private IP addresses. Your VPC already has a gateway endpoint for S3. What must you add?",[1194,1195,1196,1197],"A route in the on-premises router pointing at the gateway endpoint ID","An interface endpoint for S3, which on-premises clients reach through the Direct Connect connection","A second gateway endpoint associated with the transit gateway route table","A public virtual interface, since gateway endpoints require public routing","A gateway endpoint exists only as a route in a VPC route table, and an on-premises router has no way to target it, so gateway endpoints do not serve callers outside the VPC. Interface endpoints have real private IP addresses in your subnets, which is what makes them reachable over Direct Connect, Site-to-Site VPN, peering, and Transit Gateway. AWS documents keeping both in the same VPC so in-VPC traffic uses the free gateway endpoint while on-premises traffic uses the interface endpoint.",{"question":1200,"type":1184,"options":1201,"correctAnswer":1205,"explanation":1206},"What appears in your subnet route table when you associate that route table with a gateway endpoint for DynamoDB?",[1202,1203,1204,1205],"A route with the DynamoDB service CIDR as the destination and a NAT gateway target","Nothing, because gateway endpoints are resolved through DNS","A route with 0.0.0.0/0 as the destination and the endpoint ID as the target","A route with an AWS-managed prefix list as the destination and the endpoint ID as the target","AWS adds the route for you using the service's managed prefix list as the destination, and you can view it but cannot edit or delete it. The route is removed when you disassociate the route table or delete the endpoint. Because the prefix list is more specific than 0.0.0.0/0, longest prefix match sends same-Region service traffic to the endpoint while everything else still uses the internet gateway.",{"question":1208,"type":1184,"options":1209,"correctAnswer":1210,"explanation":1214},"A team attaches an endpoint policy to an S3 gateway endpoint that allows s3:GetObject on one bucket. A role in the VPC with the AmazonS3FullAccess policy now gets AccessDenied when it calls PutObject on that bucket. Why?",[1210,1211,1212,1213],"The endpoint policy filters requests crossing the endpoint, and an action it does not allow is refused regardless of the IAM policy","Endpoint policies override bucket policies, which removed the write permission","The IAM policy must be reattached after any endpoint policy change","Gateway endpoints support read operations only","An endpoint policy is a resource policy on the endpoint that constrains what may pass through it, so access needs a yes from the IAM policy, any resource policy such as a bucket policy, and the endpoint policy together. It never grants permission on its own, which is why replacing the default full-access policy with a narrow one silently breaks calls that IAM still allows. Gateway endpoints support the full API of the service.",{"question":1216,"type":1217,"options":1218,"correctAnswers":1223,"explanation":1224},"Which statements about interface endpoints are correct? (Choose 3.)","multiple",[1219,1220,1221,1222],"An endpoint network interface is created in each subnet you select, one subnet per Availability Zone","You associate security groups with the endpoint network interfaces","They are billed per hour in each Availability Zone plus a charge per GB processed","They add a route to your subnet route tables automatically",[1219,1220,1221],"Interface endpoints work through requester-managed network interfaces that hold private IP addresses from your subnets, so they carry security groups and cost money in every zone you enable. Route tables are untouched, because traffic reaches the endpoint by resolving a DNS name to those private addresses rather than by routing to a gateway. The route table entry belongs to the gateway endpoint model.",{"question":1226,"type":1184,"options":1227,"correctAnswer":1229,"explanation":1232},"You create an interface endpoint for Systems Manager and confirm the endpoint state is available, but ping to the endpoint IP address times out from your instance. What should you conclude?",[1228,1229,1230,1231],"The endpoint network interface is in a failed state and must be recreated","Nothing is necessarily wrong, because interface endpoints do not respond to ping","The endpoint policy is blocking ICMP","The subnet needs an outbound network ACL rule for ICMP","AWS documents that interface endpoints do not answer ICMP echo requests, and recommends testing reachability with nc or nmap against the service port instead. Treating a failed ping as proof of a broken endpoint sends people to rebuild working infrastructure. Test with a TCP connection to port 443 or an actual API call.",{"question":1234,"type":1184,"options":1235,"correctAnswer":1238,"explanation":1240},"After enabling private DNS on an interface endpoint, your applications still resolve the service's public endpoint to public IP addresses. What is the most likely cause?",[1236,1237,1238,1239],"The endpoint policy does not allow DNS actions","Private DNS takes effect only after the endpoint is recreated","The VPC does not have both DNS hostnames and DNS resolution enabled","The instances are using a custom DNS server, which is unsupported with endpoints","Private DNS works by creating a hidden AWS-managed private hosted zone that overrides the public service name, and that hosted zone requires the enableDnsSupport and enableDnsHostnames attributes on the VPC. Without both, the option can be selected but nothing resolves differently. Route 53 Resolver serves this record only inside the VPC, which is why on-premises callers need an inbound Resolver endpoint or the endpoint-specific DNS name.",{"question":1242,"type":1184,"options":1243,"correctAnswer":1247,"explanation":1248},"You want to expose an internal application running on EC2 instances to a partner's AWS account over private IP addresses, without VPC peering. What do you create in your account?",[1244,1245,1246,1247],"A gateway endpoint targeting the partner's VPC","A Gateway Load Balancer and a resource share in AWS RAM","A transit gateway attachment shared with the partner","An endpoint service backed by a Network Load Balancer, with the partner's principal added to the allowed permissions","As a service provider you front the service with a Network Load Balancer, create an endpoint service configuration that points at it, and grant specific AWS principals permission to connect. The partner then creates an interface endpoint in their VPC, and you accept or automatically accept the connection request. Nothing about this requires overlapping-free CIDRs or routing between the VPCs, which is why it scales where peering does not.",{"question":1250,"type":1184,"options":1251,"correctAnswer":1253,"explanation":1254},"True or False: instances in a VPC that is peered with your VPC can use your VPC's gateway endpoint to reach Amazon S3.",[1252,1253],"True","False","This is one of the documented edge-to-edge routing restrictions of VPC peering: a peer VPC cannot use your internet gateway, NAT device, VPN connection, Direct Connect connection, or gateway endpoint. The same restriction is why gateway endpoints are useless to on-premises callers. Each VPC needs its own gateway endpoint, or the caller needs an interface endpoint it can address directly.",{"question":1256,"type":1184,"options":1257,"correctAnswer":1258,"explanation":1262},"An interface endpoint for CloudWatch was created with a single subnet in us-east-1a. Instances in us-east-1b use it successfully today. What is the operational risk?",[1258,1259,1260,1261],"If us-east-1a is impaired, instances in us-east-1b lose access to CloudWatch","Cross-zone traffic to the endpoint is blocked by default","The endpoint will fail once concurrent connections exceed 55,000","Private DNS resolves only for instances in the same Availability Zone as the endpoint interface","The regional DNS name resolves to whatever endpoint network interfaces exist, so a single-zone endpoint serves the whole VPC and becomes a single-zone dependency for the whole VPC. AWS recommends at least 2 Availability Zones per endpoint for exactly this reason, and it then alternates between healthy interfaces using round robin. The 55,000 connection ceiling belongs to NAT gateways, not endpoints.",{"title":23,"description":24},"courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/02-private-and-hybrid-connectivity/01-vpc-endpoints-and-privatelink","877n8Kc6y-fIn3iy3SxGj9h1GhTzLPeAEJp5VlUsCSI",{"locked":5,"reason":6,"meta":1267,"item":3},{"title":1268,"description":1269,"isFree":10,"estimatedMinutes":1270,"difficulty":12,"learningObjectives":1271},"VPC Peering and Transit Gateway","VPC peering is a one to one wire between 2 VPCs with 3 hard limits; Transit Gateway is a regional router that removes all 3 and adds route tables of its own. This lesson covers both, the point where a mesh stops being viable, and how to troubleshoot the 4 layers of routing a transit gateway introduces.",30,[1272,1273,1274,1275,1276,1277],"Configure a VPC peering connection end to end, including the routes and security group references both sides need","Explain the 3 limits of VPC peering (no transitive routing, no overlapping CIDRs, no edge to edge routing) and predict which scenarios they break","Describe how a transit gateway routes traffic using attachments, route table associations, and route propagation","Build isolated and shared-services segmentation with multiple transit gateway route tables","Choose between peering and Transit Gateway for a given number of VPCs, cost profile, and routing requirement","Diagnose connectivity failures across the 4 routing layers a transit gateway introduces, including the Availability Zone attachment rule"]