AWS SAP: Interface VPC Endpoints — PrivateLink for private service access

Gateway for S3/DynamoDB. Interface ENIs for the rest. NLB storefront for cross-account services.

<!-- hal:authoritative:yaml -->

A private VPC must call AWS APIs or a partner service without traversing the public internet. PrivateLink Interface Endpoints place ENIs in your subnets. Gateway Endpoints still own S3 and DynamoDB via route-table prefix lists.

§I — Frame

Recent SAP networking seats covered Transit Gateway attachments (08-14) and Route53 failover (08-26). The landing-zone seat (08-02) covered Organizations and SCPs. Last Python/Cloud cert seat (09-04) was AZ-900 storage redundancy, an intentional fill-in on the Microsoft slot.

Today returns to AWS SAP on a facet those lessons did not spend: PrivateLink and VPC Endpoints. Bootcamp privatelink.md and the SAP notes "VPC Endpoints (Core Topic)" section are the grounding spine.

SAP loves decision trees:

• Need private S3 or DynamoDB from a VPC with no internet path → prefer Gateway Endpoint.
• Need private access to Secrets Manager, ECR API, KMS, STS, or most other AWS APIs → Interface Endpoint.
• Need to expose your own service to many consumer VPCs without peering → PrivateLink endpoint service in front of a Network Load Balancer.

Name the technique before unpacking it. Call the first pattern Prefix-List Gate. Call the second ENI Dial-Tone. Call the third NLB Storefront.

§II — Prefix-List Gate (Gateway Endpoints)

Gateway endpoints exist for S3 and DynamoDB. You create one per service per region and associate it with one or more route tables. AWS installs a prefix-list route targeting the gateway. Traffic to the service IP ranges leaves via that route instead of a NAT gateway or internet gateway.

Properties the exam hammers:

• Highly available across AZs by design (not an ENI you place).
• No security groups on the gateway itself.
• Endpoint policies can limit which buckets or tables are reachable through that gate.
• Same-region only.
• Useful for private-only bucket policies that require access via the endpoint.

If the scenario says "private subnets must read S3 without NAT" and cost sensitivity is high, Gateway Endpoint is the default answer. Interface endpoints for S3 exist too, but Gateway remains the classic SAP move for S3/DynamoDB scale and price.

§III — ENI Dial-Tone (Interface Endpoints)

Interface endpoints use PrivateLink. Each endpoint creates elastic network interfaces in the subnets you choose. Those ENIs hold private IPs. Security groups attach to the ENIs. DNS names appear: regional, zonal, and optionally Private DNS that overrides the public service hostname.

§III.A — Multi-AZ is not optional theater

Bootcamp text: deploy multiple endpoints (practically: associate subnets in every AZ that must consume the service). A single-AZ Interface endpoint is a silent availability defect. SAP scenarios that mention an AZ outage expect you to notice the missing ENI.

§III.B — Private DNS and VPC DNS attributes

Private DNS only works when the VPC has DNS hostnames and DNS support enabled. If Private DNS is off, applications must target endpoint-specific DNS names. SDKs that assume the public regional hostname will still try the public path unless you override endpoint_url.

§III.C — Endpoint policies versus IAM

An endpoint policy limits what is reachable through that endpoint. It does not grant identity permission. IAM still authorizes secretsmanager:GetSecretValue. Both gates must allow the call. Exam stems that show a correct IAM policy and a failing call often hide a restrictive endpoint policy or a missing Interface endpoint in that VPC.

§III.D — Security groups on the ENI

Interface endpoints accept security groups. Ingress should allow TCP 443 from the worker security group (or prefix list), not from 0.0.0.0/0. Egress from workers must reach the endpoint ENI. Forgetting either side produces timeouts that look like "PrivateLink is broken" when the SG is the real fault.

§IV — NLB Storefront (endpoint services)

PrivateLink also connects consumer VPCs to services hosted in other accounts. The provider places a Network Load Balancer in front of the application, creates a VPC endpoint service, and accepts connections from consumer endpoint principals. Consumers create Interface endpoints targeting that service name.

Why SAP prefers this over peering for SaaS-style exposure:

• No overlapping CIDR fights across hundreds of consumer VPCs.
• No transitive routing surprises from TGW meshes.
• Traffic stays on the AWS backbone.
• Provider controls acceptance and exposure; consumer controls endpoint SGs.

Fault tolerance: NLB in multiple AZs plus consumer ENIs in multiple AZs. One AZ on either side is an incomplete answer.

§V — Decision table for exam stems

PrivateLink is not a replacement for Transit Gateway. TGW is L3 connectivity between networks. PrivateLink is service-level exposure via ENIs.

§VI — Practice questions (q-card targets)

§VII — Tie to Ops / Dev / Go

Ops ships the boto3 census that verifies Interface endpoints, Private DNS, and AZ coverage after IaC. Dev types partial describe envelopes with TypedDict. Go ships the fleet inventory binary with SDK v2 paginators. Maghrib will fold practice items into the Cert quiz later.

§VIII — Close

Gateway endpoints steer S3 and DynamoDB with prefix lists. Interface endpoints dial AWS and partner services through ENIs and PrivateLink. Endpoint services put an NLB storefront in front of your app for many consumers. Pick the pattern from the requirement table, place ENIs in every needed AZ, and keep endpoint policies and IAM both honest.

Examine the stem for "no NAT," "overlapping CIDRs," and "S3 versus Secrets Manager" before you answer.

Related

• Python ops VPC endpoint census
• TGW (contrast)
• Route53 failover (contrast)
• Cross-References/Archmagus-Stack — Cert-Prep AWS hub
• Grounding: Bootcamp privatelink.md; SAP notes VPC Endpoints Core Topic; SAP-C02 privatelink.md