Security
AWS PrivateLink
Provides private connectivity to supported AWS services through VPC endpoints.
Key points
- Provides private connectivity between VPCs, supported AWS services, and endpoint services.
- Uses interface VPC endpoints powered by elastic network interfaces with private IP addresses.
- Keeps supported service traffic on the AWS network instead of traversing the public internet.
- Can be combined with security groups, endpoint policies, IAM, and service policies.
- Helps reduce network exposure for AI workloads that access supported AWS APIs or internal services.
When to use it
- Choose PrivateLink when a workload in a VPC needs private access to supported AWS service APIs.
- Use it for regulated workloads that should avoid public internet paths to supported services.
- Use it when private connectivity and endpoint policies are the exam clues.
Exam tips
- PrivateLink provides private network connectivity; IAM still controls service authorization.
- PrivateLink is not an encryption service; use TLS and KMS-related controls for encryption needs.
- VPC endpoints reduce public internet exposure but must be configured per supported service and region.
- Security groups and endpoint policies can further restrict endpoint access.