AWS PrivateLink

PrivateLink connects you to AWS services and to services in other VPCs (your own or third parties') through private endpoints inside your VPC, with traffic never leaving the AWS network. The consumer sees the service as a private IP in its own VPC.

Two parties are involved: consumers create VPC endpoints to reach a service, and providers publish endpoint services behind a Network Load Balancer. The consumer never sees the provider's VPC, subnets, or NLB — only the private IP of their own endpoint.

Endpoint Types

Interface endpoints (the PrivateLink mechanism) place an ENI with a private IP in your subnet; DNS resolves the service hostname to it. They work for most AWS services and third-party services, billed per AZ-hour plus per GB. Gateway endpoints are a route-table target available only for S3 and DynamoDB — and free.

Use Gateway endpoints for S3 and DynamoDB whenever possible since they cost nothing; use interface endpoints for everything else.

Endpoint Services and DNS

On the provider side, you run your service behind a Network Load Balancer, create an endpoint service pointing at it, and grant specific accounts permission to connect. Consumers create interface endpoints that tunnel through — common for SaaS sold to enterprises and for sharing internal services across accounts without peering.

Private DNS (on by default for AWS services) makes the regular service hostname resolve to the endpoint's private IP from inside the VPC, so existing SDK code hits the private endpoint with no changes.

Cost Optimization

The classic cost play: replace NAT Gateway egress to AWS services with PrivateLink. NAT Gateway charges per GB at a higher rate than interface-endpoint data processing, and the hourly endpoint fee is offset quickly at moderate traffic. For S3 and DynamoDB specifically, free Gateway endpoints beat both.