AWS VPC Support
VPC endpoints and PrivateLink setup.
VPC endpoints let your workloads reach AWS services and partner services without crossing the public internet or a NAT gateway. We choose the right endpoint type, lock it down with policies and fix the DNS and security group problems that make endpoints seem not to work.
When You Need This
The situations where this work pays for itself.
Signs it is time
- Private workloads call S3, ECR, STS or Secrets Manager through a NAT gateway
- Compliance requires traffic to stay off the public internet
- You want to expose your own service privately to other VPCs or accounts
- An endpoint exists but calls still go to the internet or time out
- ECS, EKS or Lambda in private subnets cannot pull images or fetch secrets
What you get
- An endpoint plan ranked by NAT traffic and cost
- Endpoints, policies and security groups in infrastructure as code
- Resource policies restricting access to your VPC endpoints
- Before and after NAT traffic comparison
How we do it
A clear, safe process you can follow along with.
1. Find what traffic uses NAT
We use VPC Flow Logs and NAT gateway metrics to see which AWS service destinations drive traffic, so we build the endpoints that matter first.
2. Pick the endpoint type
S3 and DynamoDB use gateway endpoints, added as route table targets. Most other services use interface endpoints, which create network interfaces in your subnets and carry hourly and per-GB charges.
3. Create interface endpoints correctly
We place them in subnets across AZs, enable private DNS, and attach a security group allowing inbound 443 from your workloads. Private DNS needs enableDnsSupport and enableDnsHostnames on the VPC.
4. Add the full set for container workloads
Pulling images from ECR privately typically needs ecr.api, ecr.dkr and an S3 gateway endpoint, and logging and secrets add CloudWatch Logs and Secrets Manager endpoints.
5. Apply endpoint and resource policies
An endpoint policy limits which principals and actions pass through. We pair it with bucket or resource policies using aws:SourceVpce so data is reachable only from your endpoint.
6. Expose your own service with PrivateLink
For a service you provide, we put it behind a Network Load Balancer, create an endpoint service, control which principals may connect and approve connection requests.
7. Verify
We resolve the service name from inside the VPC and confirm it returns private IPs, then check NAT traffic and cost fall.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Interface endpoints in one AZ only
If that AZ fails, calls fail. Cross-AZ calls also add cost.
Security group blocks 443
The endpoint network interface needs inbound 443 from clients.
Private DNS left off
Without it the standard service name still resolves publicly and bypasses the endpoint.
Overbuilding endpoints
Interface endpoints cost money each AZ. We create only those that replace significant NAT traffic or are required for compliance.
Frequently Asked Questions
What is the difference between a gateway and an interface endpoint?
Gateway endpoints exist only for S3 and DynamoDB and work through route tables. Interface endpoints use PrivateLink network interfaces and cover many other services.
What is AWS PrivateLink?
PrivateLink is the technology behind interface endpoints and endpoint services. It exposes a service to other VPCs privately without peering, route tables or internet gateways.
Why does my endpoint not seem to be used?
Private DNS may be disabled, the endpoint may not be in the same subnets or AZs as your clients, or the workload uses a custom DNS resolver that returns public addresses.
Want Help With VPC endpoints and PrivateLink setup?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required