12.2 Private Network Connectivity: VPC Endpoints & Peering

AWS Certified CloudOps Engineer – Associate SOA-C03

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Monitoring & Observability Infrastructure

1.1 Configuring Workload Observability 1.2 CloudWatch Agent Architecture & Deployment 1.3 Metric Alarms, Anomaly Detection & Composite Alarms

2 Chapter 2: Alarms, Dashboards & Event-Driven Remediation

2.1 CloudWatch Dashboards & Multi-Account Visibility 2.2 Notification Architecture & Alarm Invocation 2.3 Amazon EventBridge Rules, Event Buses & Troubleshooting 2.4 Automated Remediation with Systems Manager & Lambda

3 Chapter 3: Performance Optimization for Compute, Storage & Databases

3.1 EC2 & Compute Performance Optimization 3.2 Amazon EBS Performance Metrics & Volume Tuning 3.3 S3 Performance Strategies & Data Transfer 3.4 Shared Storage (EFS/FSx) & Database Performance

4 Chapter 4: Compute & Database Scalability and Elasticity

4.1 EC2 Auto Scaling Policies & Elasticity 4.2 Auto Scaling Advanced Operations: Warm Pools & Lifecycle Hooks 4.3 Dynamic Scalability Through Caching 4.4 Managed Database Scaling: RDS, Aurora & DynamoDB

5 Chapter 5: High Availability, Fault Tolerance & Load Balancing

5.1 Elastic Load Balancing (ALB/NLB) Configuration & Troubleshooting 5.2 Route 53 Health Checks & DNS Failover 5.3 Multi-AZ Architecture & Fault-Tolerant Deployments

6 Chapter 6: Backup, Data Protection & Disaster Recovery

6.1 Centralized Backup Automation & AWS Backup 6.2 Database Restore Strategies & RTO/RPO Management 6.3 Storage Versioning, Replication & Immutability 6.4 Disaster Recovery Patterns & Multi-Region Resilience

7 Chapter 7: Infrastructure as Code with CloudFormation & AWS CDK

7.1 CloudFormation Foundations & Resource Modeling 7.2 Managing Stacks, Drift Detection & Change Sets 7.3 Infrastructure as Code with AWS CDK 7.4 Identifying & Remediating Deployment Failures

8 Chapter 8: Multi-Account Provisioning, Containers & Third-Party IaC

8.1 Golden Images with EC2 Image Builder & Amazon ECR 8.2 Multi-Account & Multi-Region Resource Sharing 8.3 Deployment Strategies & Container Deployments 8.4 Third-Party Automation with Terraform & Git Workflows

9 Chapter 9: Systems Manager & Event-Driven Operations Automation

9.1 AWS Systems Manager Core Management & Run Command 9.2 Systems Manager Patch Manager & Session Manager 9.3 Event-Driven Operations Automation

10 Chapter 10: Identity, Access Management & Governance

10.1 Advanced IAM Policies, Roles & Policy Conditions 10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer 10.3 Multi-Account Security: Organizations, SCPs & Identity Center 10.4 Compliance Enforcement with AWS Config & Conformance Packs

11 Chapter 11: Data Security, Encryption & Vulnerability Management

11.1 Data Classification & Amazon S3 Security 11.2 Encryption at Rest with AWS Key Management Service (KMS) 11.3 Encryption in Transit with AWS Certificate Manager (ACM) 11.4 Secrets Management & Centralized Security Findings

12 Chapter 12: VPC Architecture, Endpoints & Network Protection

12.1 VPC Core Architecture, Subnetting & High Availability NAT 12.2 Private Network Connectivity: VPC Endpoints & Peering 12.3 Network Protection & Edge Security Auditing

13 Chapter 13: DNS, Route 53 Routing & Content Delivery

13.1 DNS Architecture & Route 53 Resolver for Hybrid Clouds 13.2 Route 53 Advanced Routing Policies & Query Logging 13.3 Global Content & Service Distribution: CloudFront & Global Accelerator

14 Chapter 14: Network Troubleshooting, Traffic Analysis & Hybrid Connectivity

14.1 VPC Configuration Troubleshooting & Analysis Tools 14.2 Network Traffic Analysis: VPC Flow Logs & Log Analytics 14.3 CloudFront Caching & Hybrid Connectivity Troubleshooting

12.2 Private Network Connectivity: VPC Endpoints & Peering

Key Takeaways Explain This Topic AI

Gateway VPC Endpoints provide free, route table-based private connectivity exclusively for Amazon S3 and DynamoDB, but are strictly non-transitive and cannot be accessed from on-premises or peered VPCs.

VPC Endpoint Policies attached to endpoints restrict accessible resources (such as specific S3 bucket ARNs) to prevent corporate data exfiltration.

Interface VPC Endpoints (AWS PrivateLink) provision Elastic Network Interfaces (ENIs) with private IP addresses in subnets, supporting over 100 AWS services and transitive hybrid routing.

Private DNS for Interface Endpoints automatically overrides public service domain names to resolve to private ENI IP addresses, requiring enableDnsHostnames and enableDnsSupport on the VPC.

VPC Peering enables 1:1 non-transitive connections without overlapping CIDRs, supporting up to 9001-byte jumbo frames intra-Region but capping MTU at 1500 bytes cross-Region.

Last updated: September 2026

12.2 Private Network Connectivity: VPC Endpoints & Peering

CloudOps Blueprint Focus: The AWS Certified CloudOps Engineer – Associate (SOA-C03) exam tests your ability to establish private network connectivity without traversing the public internet. You must master the architectural differences between Gateway Endpoints and Interface Endpoints (AWS PrivateLink), configure endpoint policies to prevent data exfiltration, ensure private DNS resolution, and navigate VPC Peering constraints including non-transitive routing and MTU limits.

Private Connectivity: Gateway Endpoints vs. Interface Endpoints

AWS provides VPC Endpoints to connect VPC resources to supported AWS services and partner applications without an Internet Gateway, NAT Gateway, or public IP addresses. VPC Endpoints fall into two distinct architectures: Gateway Endpoints and Interface Endpoints (AWS PrivateLink) .

Architectural Dimension Gateway Endpoints Interface Endpoints (AWS PrivateLink)

Supported Services Amazon S3 and Amazon DynamoDB only. 100+ AWS services , custom internal services, and SaaS.

Implementation Route table entry targeting an AWS Prefix List ( pl-xxxx ). Elastic Network Interface (ENI) with private IP via NLB.

Cost Model Free ($0.00) . No hourly or data processing charges. Paid . ~$0.01/hour per AZ ENI + $0.01 per GB processed.

Extended Reach VPC-local only . Inaccessible from VPN, DX, or Peering. Transitive reach . Accessible over DX, VPN, Peering, and TGW.

DNS Configuration Standard DNS; routed via prefix lists. Private DNS overrides public service domain names.

Security Controls VPC Endpoint Policy. Security Groups attached to ENIs + VPC Endpoint Policy.

Gateway Endpoints: Route Table Targets & Endpoint Policies

A Gateway Endpoint is a managed routing target for VPC route tables connecting to Amazon S3 or Amazon DynamoDB.

Routing Mechanics & Prefix Lists

Creating a Gateway Endpoint generates an entry in selected route tables pointing to an AWS Prefix List representing regional service IP ranges: Destination: pl-63a5400a (com.amazonaws.us-east-1.s3) ⟶ Target: vpce-xxxx \text{Destination: } \texttt{pl-63a5400a (com.amazonaws.us-east-1.s3)} \longrightarrow \text{Target: } \texttt{vpce-xxxx} Destination: pl-63a5400a (com.amazonaws.us-east-1.s3) ⟶ Target: vpce-xxxx

Because the prefix list is more specific than the default route ( 0.0.0.0/0 ), traffic to S3 or DynamoDB routes across the AWS private network, bypassing NAT Gateways and eliminating data processing fees.

Non-Transitive Boundary Limitation

Gateway Endpoints cannot be accessed from outside the VPC :

On-premises hosts connected via AWS Direct Connect or Site-to-Site VPN cannot route through a VPC to reach a Gateway Endpoint.

Peered VPCs and Transit Gateways cannot route traffic to a Gateway Endpoint in another VPC.

Gateway Endpoints only serve resources within subnets associated with the designated VPC route tables.

Endpoint Policies for Data Exfiltration Prevention

By default, Gateway Endpoints permit access to any S3 bucket across any AWS account. To prevent unauthorized exfiltration to external accounts, attach a VPC Endpoint Policy : {

"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowCorporateBucketsOnly",
"Effect": "Allow",
"Principal": "*",
"Action": ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
"Resource": [
"arn:aws:s3:::corp-production-storage",
"arn:aws:s3:::corp-production-storage/*"
]
}
]
}

Requests to unauthorized buckets through this endpoint are rejected with an HTTP 403 Forbidden error.

Interface Endpoints (AWS PrivateLink) & Private DNS

Interface Endpoints use AWS PrivateLink to provide private access to over 100 AWS services (e.g., EC2, SSM, Secrets Manager, KMS, and S3 Interface endpoints), third-party SaaS platforms, and internal microservices.

Elastic Network Interfaces (ENIs) & Hybrid Reach

Provisioning an Interface Endpoint places an Elastic Network Interface (ENI) with a private IP address into each designated subnet. Traffic flows through the ENI to an AWS-managed Network Load Balancer (NLB) fronting the service fleet:

Security Groups: Standard security groups attach to the endpoint ENIs to restrict inbound traffic to authorized source CIDRs and ports (typically TCP 443).

Hybrid Accessibility: Because Interface Endpoints have private IP addresses, they are fully routable from on-premises over AWS Direct Connect or Site-to-Site VPN, across VPC Peering connections, and through AWS Transit Gateway.

Private DNS Resolution Mechanics

Interface Endpoints generate specific regional DNS hostnames (e.g., vpce-xxxx.s3.us-east-1.vpce.amazonaws.com ). Enabling Private DNS creates a private Route 53 zone overriding the public service endpoint (e.g., secretsmanager.us-east-1.amazonaws.com ), resolving it directly to the endpoint ENI private IPs:

Applications and SDKs continue using standard endpoint URLs without code modifications.

Prerequisites: Both enableDnsHostnames and enableDnsSupport must be set to true on the VPC for Private DNS to function.

VPC Peering: Architecture, Constraints & MTU Tuning

VPC Peering creates a 1:1 network connection between two VPCs within the same Region or across Regions and accounts. All traffic travels over the private AWS backbone with physical-layer encryption.

Core Peering Constraints

No Overlapping CIDRs: VPCs with matching or overlapping CIDR blocks cannot be peered.

Bidirectional Route Tables: Routes must be added manually in both VPC route tables directing the peer CIDR to the peering connection ID ( pcx-xxxx ).

Security Group Referencing: Intra-Region peering allows referencing peer security groups by ID. Cross-Region peering does not support peer security group references; rules must use CIDR blocks.

The Non-Transitive Routing Constraint

VPC Peering does not support transitive routing : VPC A ⟷ VPC B ⟷ VPC C ⇏ VPC A ⟷ VPC C \text{VPC A} \longleftrightarrow \text{VPC B} \longleftrightarrow \text{VPC C} \quad \nRightarrow \quad \text{VPC A} \longleftrightarrow \text{VPC C} VPC A ⟷ VPC B ⟷ VPC C ⇏ VPC A ⟷ VPC C

Traffic cannot hop through an intermediate VPC. Connecting multiple VPCs requires either:

Full Mesh Peering: Direct peering links between every VPC pair ( N ( N − 1 ) 2 \frac{N(N-1)}{2} 2 N ( N − 1 ) links; 10 VPCs require 45 links).

AWS Transit Gateway: A central regional hub-and-spoke router supporting transitive routing across thousands of VPCs and on-premises connections.

MTU Configurations

Intra-Region Peering: Supports Jumbo Frames up to 9001 bytes , optimizing throughput for high-volume transfers.

Cross-Region Peering: Strictly capped at 1500 bytes . Packets exceeding 1500 bytes are fragmented or dropped.