Lesson 09 — VPC Endpoints & AWS PrivateLink

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 04 – Amazon VPC & Network Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand VPC Endpoints.
Understand AWS PrivateLink.
Differentiate Gateway and Interface Endpoints.
Configure VPC Endpoints.
Verify private connectivity.
Improve security by removing Internet dependency.
Apply enterprise networking best practices.

📚 Lesson Information

Estimated Time: 2 Hours

Difficulty: Intermediate

Prerequisites: Lesson 08 – Network ACLs (NACLs)

Hands-on Lab: Yes

💼 Business Value

Imagine your company needs to access:

Amazon S3
Amazon DynamoDB
AWS Systems Manager
Amazon ECR
AWS Secrets Manager

Most beginners assume traffic must travel through:

Server

↓

Internet

↓

AWS Service

But that introduces unnecessary risks.

Internet exposure
NAT Gateway costs
Higher latency
Additional attack surface

AWS provides a better solution.

VPC Endpoints allow communication with AWS services without leaving the AWS network.

🏢 CloudNova Scenario

CloudNova’s Application Servers need access to:

Amazon S3
AWS Systems Manager
Amazon ECR
AWS Secrets Manager

Current architecture

EC2

↓

NAT Gateway

↓

Internet

↓

Amazon S3

The Security Team wants:

No Internet dependency
Lower NAT Gateway costs
Private communication
Better compliance

The solution:

VPC Endpoints

🌍 What is a VPC Endpoint?

A VPC Endpoint allows resources inside your VPC to privately communicate with supported AWS services.

Traffic never traverses:

Public Internet
Internet Gateway
NAT Gateway

Everything remains on the AWS private network.

Before VPC Endpoint

EC2

↓

Private Route Table

↓

NAT Gateway

↓

Internet Gateway

↓

Internet

↓

Amazon S3

After VPC Endpoint

EC2

↓

Private Route Table

↓

VPC Endpoint

↓

Amazon S3

No Internet involved.

Benefits of VPC Endpoints

✅ Improved Security

✅ Reduced NAT Gateway usage

✅ Lower latency

✅ Better compliance

✅ Private AWS communication

✅ Simpler architecture

Types of VPC Endpoints

AWS supports two primary endpoint types.

Type	Used For
Gateway Endpoint	Amazon S3, DynamoDB
Interface Endpoint	Most AWS Services

Gateway Endpoint

Gateway Endpoints support:

Amazon S3
Amazon DynamoDB

They are:

Free of hourly charges
Added to Route Tables
Highly available
Managed by AWS

Architecture

Private EC2

↓

Gateway Endpoint

↓

Amazon S3

Interface Endpoint

Interface Endpoints are powered by AWS PrivateLink.

They create one or more Elastic Network Interfaces (ENIs) inside your subnet.

Supported services include:

Systems Manager
CloudWatch
Secrets Manager
ECR
KMS
SNS
SQS
API Gateway

Architecture

Private EC2

↓

Interface Endpoint (ENI)

↓

AWS Service

🌐 What is AWS PrivateLink?

AWS PrivateLink enables private connectivity between:

VPCs
AWS Services
SaaS Providers
Partner Services

Traffic stays completely within AWS.

No:

Public IP
VPN
Internet Gateway

is required.

CloudNova Enterprise Architecture

                    AWS Cloud

             Amazon S3
                  ▲
                  │
      Gateway Endpoint
                  ▲
                  │
         Private Route Table
                  ▲
                  │
         Private App Subnet
                  ▲
                  │
              EC2 Instance

────────────────────────────────

         Secrets Manager
                  ▲
                  │
        Interface Endpoint
                  ▲
                  │
             Private ENI
                  ▲
                  │
              EC2 Instance

Enterprise Example

CloudNova stores:

Student Videos
Study Guides
PDF Notes
Practice Exams

inside Amazon S3.

Instead of:

EC2

↓

Internet

↓

Amazon S3

the company uses

EC2

↓

Gateway Endpoint

↓

Amazon S3

This eliminates unnecessary Internet traffic.

🛠 Lab 01 — Create an Amazon S3 Gateway Endpoint

Open

AWS Console

↓

VPC

↓

Endpoints

Click

Create Endpoint

Configure Endpoint

Service Category

AWS Services

Service

com.amazonaws.ap-south-1.s3

Type

Gateway

Select:

CloudNova-VPC

Choose

Private Route Table

Click

Create Endpoint

Verify Route Table

Open

VPC

↓

Route Tables

↓

Private-RT

↓

Routes

Notice a new route similar to:

Destination

pl-xxxxxxxx

↓

Target

vpce-xxxxxxxx

AWS manages this automatically.

🛠 Lab 02 — Test Amazon S3 Access

Launch an EC2 instance in the Private Subnet.

Connect using Session Manager or Bastion Host.

Run:

aws s3 ls

Expected

Bucket list displayed successfully.

Traffic uses the Gateway Endpoint instead of the Internet.

🛠 Lab 03 — Create an Interface Endpoint

Open

VPC

↓

Endpoints

↓

Create Endpoint

Service

Systems Manager

Type

Interface

Select

CloudNova-VPC
Private-App-Subnet

Select Security Group

Endpoint-SG

Enable

Private DNS

Click

Create Endpoint

AWS creates one or more Elastic Network Interfaces.

Verify Interface Endpoint

Navigate

EC2

↓

Network Interfaces

You should see AWS-managed ENIs created for the Interface Endpoint.

💻 AWS CLI Lab

List Available Endpoint Services

aws ec2 describe-vpc-endpoint-services

Create Amazon S3 Gateway Endpoint

aws ec2 create-vpc-endpoint \
    --vpc-id vpc-xxxxxxxx \
    --service-name com.amazonaws.ap-south-1.s3 \
    --vpc-endpoint-type Gateway \
    --route-table-ids rtb-private

Create Systems Manager Interface Endpoint

aws ec2 create-vpc-endpoint \
    --vpc-id vpc-xxxxxxxx \
    --service-name com.amazonaws.ap-south-1.ssm \
    --vpc-endpoint-type Interface \
    --subnet-ids subnet-private \
    --security-group-ids sg-endpoint

List Endpoints

aws ec2 describe-vpc-endpoints

View Endpoint Details

aws ec2 describe-vpc-endpoints \
    --vpc-endpoint-ids vpce-xxxxxxxx

✅ Verification

Confirm:

Gateway Endpoint

Amazon S3

↓

Private Route Table

↓

Gateway Endpoint

Interface Endpoint

Private Subnet

↓

ENI

↓

AWS Systems Manager

Run

aws s3 ls

Expected

Buckets listed successfully.

Run

aws ec2 describe-vpc-endpoints

Verify

State = Available

🔍 Troubleshooting

Problem

Cannot access Amazon S3.

Check

Gateway Endpoint exists.
Correct Route Table selected.
IAM permissions.
Bucket policy.

Problem

Interface Endpoint unavailable.

Verify

Endpoint Status = Available.
Security Group attached.
Private DNS enabled.
Correct subnet selected.

Problem

AWS CLI timeout.

Check

VPC DNS Hostnames enabled.
VPC DNS Resolution enabled.
Route Tables.
Security Groups.

🏢 Enterprise Notes

CloudNova standards:

Use Gateway Endpoints for Amazon S3 and DynamoDB.
Use Interface Endpoints for Systems Manager, ECR, KMS and Secrets Manager.
Enable Private DNS whenever possible.
Restrict Endpoint Security Groups.
Monitor endpoint usage using AWS CloudTrail and VPC Flow Logs.
Replace NAT Gateway traffic with VPC Endpoints where appropriate to improve security and reduce costs.

🚫 Common Mistakes

❌ Using NAT Gateway for Amazon S3 when a Gateway Endpoint is available.

❌ Forgetting to associate the correct Route Table.

❌ Leaving Interface Endpoint Security Groups open to everyone.

❌ Forgetting to enable Private DNS.

❌ Assuming all AWS services use Gateway Endpoints.

❌ Ignoring IAM permissions and Bucket Policies.

🧪 DIY Challenge

Using your AWS account:

Create:

Amazon S3 Gateway Endpoint
AWS Systems Manager Interface Endpoint

Configure:

Associate the Gateway Endpoint with your Private Route Table.
Enable Private DNS for the Interface Endpoint.
Attach an appropriate Security Group to the Interface Endpoint.

Verify:

aws s3 ls works from a Private EC2 instance.
Systems Manager can communicate using the Interface Endpoint.
Route Table contains the Gateway Endpoint route.
Interface Endpoint status is Available.

Take screenshots of:

VPC Endpoints
Route Tables
Network Interfaces
AWS CLI output (describe-vpc-endpoints)
Successful aws s3 ls command

📊 Knowledge Check

What is a VPC Endpoint?
Why are VPC Endpoints more secure than Internet-based access?
What is the difference between Gateway and Interface Endpoints?
Which AWS services support Gateway Endpoints?
Which AWS services typically use Interface Endpoints?
What is AWS PrivateLink?
Why should Private DNS be enabled for Interface Endpoints?
Which AWS CLI command lists all VPC Endpoints?
How can VPC Endpoints reduce NAT Gateway costs?
Why do enterprises prefer private connectivity to AWS services?

💡 Key Takeaways

After completing this lesson, you should understand:

VPC Endpoints allow private communication with AWS services without traversing the public Internet.
Gateway Endpoints are used for Amazon S3 and DynamoDB, while Interface Endpoints use AWS PrivateLink for most other AWS services.
AWS PrivateLink enables secure, private connectivity between VPCs, AWS services and partner applications.
Replacing Internet-based access with VPC Endpoints improves security, reduces latency and can lower NAT Gateway costs.
Designing private connectivity is a core responsibility of Cloud Security Engineers building secure and enterprise-ready AWS environments.

🚀 Next Lesson

➡️ Lesson 10 — Enterprise VPC Architecture