AWS VPC Endpoints

VPC Endpoints

  • VPC endpoint enables the creation of a private connection between VPC to supported AWS services and VPC endpoint services powered by PrivateLink using its private IP address
  • VPC Endpoint does not require a public IP address, access over the Internet, NAT device, a VPN connection, or AWS Direct Connect.
  • Traffic between VPC and AWS service does not leave the Amazon network
  • Endpoints are virtual devices, that are horizontally scaled, redundant, and highly available VPC components that allow communication between instances in the VPC and AWS services without imposing availability risks or bandwidth constraints on your network traffic.
  • Endpoints currently do not support cross-region requests, ensure that the endpoint is created in the same region as the S3 bucket
  • AWS currently supports the following types of Endpoints
    • VPC Gateway Endpoints
    • VPC Interface Endpoints

VPC Gateway Endpoints

  • A VPC Gateway Endpoint is a gateway that is a target for a specified route in the route table, used for traffic destined to a supported AWS service.
  • VPC Gateway Endpoint currently supports S3 and DynamoDB services
  • VPC Endpoint policy and Resource-based policies can be used for fine-grained access control.

 

AWS VPC Endpoints

 

Gateway Endpoint Configuration

  • Endpoint requires the VPC and the service to be accessed via the endpoint
  • The endpoint needs to be associated with the Route table and the route table cannot be modified to remove the route entry. It can only be deleted by removing the Endpoint association with the Route table
  • A route is automatically added to the Route table with a destination that specifies the prefix list of service and the target with the endpoint id for e.g. A rule with destination pl-68a54001 (com.amazonaws.us-west-2.s3) and a target with this endpoints’ ID (e.g. vpce-12345678) will be added to the route tables
  • Access to the resources in other services can be controlled by endpoint policies
  • Security groups need to be modified to allow outbound traffic from the VPC to the service that is specified in the endpoint. Use the service prefix list ID for e.g. com.amazonaws.us-east-1.s3 as the destination in the outbound rule
  • Multiple endpoints can be created in a single VPC, for e.g., to multiple services.
  • Multiple endpoints can be created for the same service but in different route tables.
  • Multiple endpoints to the same service CAN NOT be specified in a single route table

Gateway Endpoint Limitations

  • Endpoints are supported within the same Region only. Endpoint cannot be created between a VPC and an AWS service in a different region.
  • Endpoints support IPv4 traffic only.
  • Endpoint cannot be transferred from one VPC to another, or from one service to another
  • Endpoint connections cannot be extended out of a VPC i.e. resources across the VPN connection, VPC peering connection, AWS Direct Connect connection cannot use the endpoint

VPC Endpoint policy

  • VPC Endpoint policy is an IAM resource policy attached to an endpoint for controlling access from the endpoint to the specified service.
  • Endpoint policy, by default, allows full access to any user or service within the VPC, using credentials from any AWS account to any S3 resource; including S3 resources for an AWS account other than the account with which the VPC is associated
  • Endpoint policy does not override or replace IAM user policies or service-specific policies (such as S3 bucket policies).
  • Endpoint policy can be used to restrict which specific resources can be accessed using the VPC Endpoint.

S3 Bucket Policies

  • As the communication takes place privately with private IPs and Bucket policies does not allow access from a VPC IPv4 CIDR range (the private IPv4 address range).
  • S3 Bucket Policies can be used to restrict access through the VPC endpoint only.

VPC Gateway Endpoint Troubleshooting

  • Verify the services are within the same region.
  • DNS resolution must be enabled in the VPC
  • Route table should have a route to S3 using the gateway VPC endpoint.
  • Security groups should have outbound traffic allowed VPC endpoint.
  • NACLs should allow inbound and outbound traffic.
  • Gateway Endpoint Policy should define access to the resource
  • Resource-based policies like the S3 bucket policy should allow access to the VPC endpoint or the VPC.

VPC Interface Endpoints – PrivateLink

AWS Private Links

  • VPC Interface endpoint enables connectivity to services powered by AWS PrivateLink.
  • Services include AWS services like CloudTrail, CloudWatch, etc., services hosted by other AWS customers and partners in their own VPCs (referred to as endpoint services), and supported AWS Marketplace partner services.
  • VPC Interface Endpoints only allow traffic from VPC resources to the endpoints and not vice versa
  • PrivateLink endpoints can be accessed across both intra- and inter-region VPC peering connections, Direct Connect and VPN connections.
  • Interface Endpoints configuration process involves
    • Create an interface endpoint, and provide the name of the AWS service, endpoint service, or AWS Marketplace service
    • Choose the subnet to use the interface endpoint by creating an endpoint network interface.
    • An endpoint network interface is assigned a private IP address from the IP address range of the subnet and keeps this IP address until the interface endpoint is deleted
    • A private IP address also ensures the traffic remains private without any changes to the route table.
  • VPC Interface Endpoints by default have an address like vpce-svc-01234567890abcdef.us-east-1.vpce.amazonaws.com which needs application changes to point to the service.
  • Private DNS name feature allows consumers to use AWS service public default DNS names which would point to the private VPC endpoint service.
  • Interface Endpoints can be used to create custom applications in VPC and configure them as an AWS PrivateLink-powered service (referred to as an endpoint service) exposed through a Network Load Balancer.
  • Custom applications can be hosted within AWS or on-premises (via Direct Connect or VPN)

Interface Endpoint Limitations

  • For each interface endpoint, only one subnet per AZ can be selected.
  • Interface Endpoint supports TCP traffic only.
  • Endpoints are supported within the same region only. 
  • Endpoints support IPv4 traffic only.
  • Each interface endpoint can support a bandwidth of up to 10 Gbps per AZ, by default, and automatically scales to 40 Gbps. Additional capacity may be added by reaching out to AWS support.
  • NACLs for the subnet can restrict traffic, and needs to be configured properly
  • Endpoints cannot be transferred from one VPC to another, or from one service to another.

S3 VPC Endpoints Strategy

  • S3 is now accessible with both VPC Gateway Endpoints and VPC Interface Endpoints.

S3 Strategy - VPC Gateway Endpoints vs VPC Interface Endpoints

AWS Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. You have an application running on an Amazon EC2 instance that uploads 10 GB video objects to amazon S3. Video uploads are taking longer than expected inspite of using multipart upload cause of internet bandwidth, resulting in poor application performance. Which action can help improve the upload performance?
    1. Apply an Amazon S3 bucket policy
    2. Use Amazon EBS provisioned IOPS
    3. Use VPC endpoints for S3
    4. Request a service limit increase
  2. What are the services supported by VPC endpoints, using Gateway endpoint type? Choose 2 answers
    1. Amazon S3
    2. Amazon EFS
    3. Amazon DynamoDB
    4. Amazon Glacier
    5. Amazon SQS
  3. What are the different types of endpoint types supported by VPC endpoints? Choose 2 Answers
    1. Gateway
    2. Classic
    3. Interface
    4. Virtual
    5. Network
  4. An application running on EC2 instances processes sensitive information stored on Amazon S3. The information is accessed over the Internet. The security team is concerned that the Internet connectivity to Amazon S3 is a security risk. Which solution will resolve the security concern?
    1. Access the data through an Internet Gateway.
    2. Access the data through a VPN connection.
    3. Access the data through a NAT Gateway.
    4. Access the data through a VPC endpoint for Amazon S3.
  5. You need to design a VPC for a three-tier architecture, a web application consisting of an Elastic Load Balancer (ELB), a fleet of web/application servers, and a backend consisting of an RDS database. The entire Infrastructure must be distributed over 2 availability zones. Which VPC configuration works while assuring the least components are exposed to Internet?
    1. Two public subnets for ELB, two private subnets for the web-servers, two private subnets for RDS and DynamoDB
    2. Two public subnets for ELB and web-servers, two private subnets for RDS and DynamoDB
    3. Two public subnets for ELB, two private subnets for the web-servers, two private subnets for RDS and VPC Endpoints for DynamoDB
    4. Two public subnets for ELB and web-servers, two private subnets for RDS and VPC Endpoints for DynamoDB

References

AWS_VPC_User_Guide_-_Endpoints

27 thoughts on “AWS VPC Endpoints

    1. Thanks doanda86, yup there has been an update from AWS sometime back. Update the same.

    1. thanks Dave, it seems like Amazon Affiliate script is breaking the docs link. Let me check further.

    1. Hi Puneet, for interviews I usually recommend get your theory concepts right. Get your hands on using Free Tier, Qwiklabs, and Implement AWS projects. Also watch Re-Invent videos on architecture mainly.

  1. We have our application on Singapore Region and want to use the SES Service (Closest Endpoint) in EU-Ireland.Apparently VPC Endpoint doesn’t supports Service in cross region. PrivateLink doesn’t look promising (no clarity whether it supports cross region AWS Service (SES) if though how the connectivity can be established between regions,using Direct Connect or VPN ? Any idea how this can be achieved

  2. For Question 5, how come (a) also is not correct. Aren’t the same number of servers exposed to internet in both (a) and (d). The only difference is that in (d) we using Endpoint

    The question is asking for least number of components exposed to internet. In both answers it is the 2 web servers.

    If you can please clarify why (d) picked over (a).

    Thanks in advance. Fantastic Blog!

    1. for Q5, B & D have web servers in public subnet and hence exposed. Between a and c, you don’t have DynamoDB in private subnet and you can limit you applications access to DynamoDB using VPC endpoint which is internal and does not go through internet

      1. Hi,
        Answer a) in question 5: “(…) two private subnets for RDS and DynamoDB”. I read it as those two private subnets are for both: RDS and DynamoDB. Therefore answers a) and c) would result in the same? Or am I missing something?

        Really nice job with this blog.

        1. DynamoDB does not need any subnets, so A and C are still different options with C being more correct.

  3. Hi Jayendra

    Great Informative article. I have question about cross account capability for vpc endpoints. Use case I am looking for, is, I want to have private API connectivity to APIs hosted through APIGW in one account, and other ec2 instances in different accounts, but coming under same org.
    Can I have a vpc endpoint enabling private connectivity between vpc in Account A, to a service (APIGW) in Account B. Or what would be the typical approach here. It would be great to know your thoughts on this.

  4. Hi Jayendra,
    Nice article. One thing that is not clear, consider the following scenario:

    Lets say I have a ECS service and a lambda running in a VPC. Both ECS service and lambda access SQS service and Postgres database in RDS. Everythings works. Now, I create a VPC endpoint for SQS. Do I need another VPC endpoint for my services to access RDS? I know the RDS traffic leaves the VPC but my question is will the services be able to access RDS as before?

    1. RDS does not need VPC endpoint. As Lambda is already in VPC, it can access RDS private endpoint directly.

  5. Hi sir pls answer,

    A sysops administrator created an AWS Lambda function within a VPC with no access to the Internet. The Lambda function pulls messages from an Amazon SQS queue and stores them in an Amazon RDS instance in the same VPC. After executing the Lambda function, the data is not showing up on the RDS instance.Which of the following are possible causes for this? (Choose two.)
    * A. A VPC endpoint has not been created for Amazon RDS
    * B. A VPC endpoint has not been created for Amazon SQS
    * C. The RDS security group is not allowing connections from the Lambda function
    * D. The subnet associated with the Lambda function does not have an internet gateway attached
    * E. The subnet associated with the Lambda function has a NAT gateway.

    1. B & C. SQS needs VPC Interface Endpoint and RDS should allow connections from Lambda.

  6. Q5 bothers me much – the correct answer has VPC Endpoint for DynamoDB, which is surely meeting the requirements of least traffic outside AWS.
    BUT… The question doesn’t ask for DynamoDB at all… Neither it does for S3 nor for any other AWS service that would need to use VPC Endpoint.
    The answer C is still the only correct answer, but it doesn’t really fit to the question.

  7. Endpoint connections cannot be extended out of a VPC i.e. resources across the VPN connection, VPC peering connection, AWS Direct Connect connection cannot use the endpoint

    Is not correct as from Oct 10, 2018
    AWS PrivateLink now supports access over Inter-Region VPC Peering

Comments are closed.