AWS PrivateLink
Private connectivity to services
Lets you access AWS services, SaaS or another account's services through an interface VPC endpoint (an ENI with a private IP) without going over the Internet and without peering or NAT.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?Yes
- Managed by AWS
- In examsSAA · SOA · DVA
Think of it asLike a private back door connecting your office straight to a partner's warehouse, without going out onto the street.
When to use it
✓ Use it when
Exposing one service to many VPCs/accounts without opening up the entire network.
✗ Avoid it when
You need full network connectivity between many VPCs → Transit Gateway / VPC peering; you only access S3/DynamoDB → free gateway endpoint.
Common uses
- Calling AWS APIs (SQS, KMS…) from private subnets without NAT
- Offering SaaS to customers through an endpoint service
- Sharing internal services between accounts
What does it cost?
- Pricing model: Charged hourly per interface endpoint per AZ plus GB of data processed.
Many endpoints × many AZs × many VPCs add up quite quickly.
When the question says access one service from many VPCs or accounts, no Internet, possibly overlapping CIDRs, choose PrivateLink; to connect whole networks, choose Transit Gateway or peering; for free private access to S3 or DynamoDB, choose a gateway endpoint.
Frequently asked questions
How is PrivateLink different from VPC peering?
VPC peering connects two networks, so each side can reach more of the other, and CIDR ranges must not overlap. PrivateLink exposes only one service through an interface endpoint, one way from the consumer to the provider, so overlapping IP ranges work and the rest of the network stays hidden.
How do gateway endpoints and interface endpoints differ?
Gateway endpoints are only for S3 and DynamoDB, work through a route table entry, and have no hourly charge. Interface endpoints (PrivateLink technology) are ENIs with private IPs in your subnets, work for many AWS services, SaaS and your own services, and are billed per hour plus data processed.
What do I need to share my own service with other VPCs or accounts through PrivateLink?
The provider puts the service behind a Network Load Balancer (or Gateway Load Balancer) and creates an endpoint service. Consumers create an interface endpoint pointing to it, and the provider can approve each connection request. This scales to many customers without peering or NAT.
Related services
SAA-C03 study guide
PrivateLink is covered in these study modules: