Interface VPC Endpoints

Interface VPC Endpoints

These Interface Endpoints are just like elastic network interface in your VPC, and as soon as it is      created. AWS creates a regional and Zonal DNS entries that will resolve to local IP address within your VPC.

• Using this design, it will allow you to switch your connection gracefully from public AWS endpoints to your private VPC endpoints, without causing any downtime.
• AWS Cloud Services that are supported by this Interface VPC endpoints are: Amazon Ec2 API, Amazon EC2 System Manager (SSM), Amazon Kinesis, Elastic Load balancer API etc.
• Interface Endpoint also supports connectivity over AWS direct connect. The Interface VPC endpoints access method is also called as AWS private link for AWS Services.

Below figure explains how Amazon Kinesis Endpoint interface is communicated via AWS Private link or Interface VPC Endpoints.

Below are some guidelines which are very much used, while accessing services over interface VPC endpoints.

• VPC Interface Endpoints can be accessed from AWS direct Connect, but are not accessed via AWS managed VPN connection or via VPC Peering.
• In some Availability Zone, Some AWS Service are not accessed by VPC interface Endpoints within your VPC.
• Each VPC Interface Endpoint can provide up to 10 GB bandwidth per Availability zones. Additional capacity may be added based on usage.
• One AWS service require one VPC interface Endpoint in each Availability zones.
• VPC interface Endpoints supports only IPv4 traffic only.
• Traffic only be generated from clients to AWS Cloud Services and it is not vice versa.

AWS private Link for Customer & partner Services

AWS private link provide you access or share a service between your VPC or accounts using Network load balancer to create VPC Endpoint services.

With this design you can be able to access someone else service privately.

This Service uses private and Public DNS, Network Load balancer and Elastic Interface to operate between VPC.

VPC Private link allow only consumer to originate connection to provider, Provider will not be able to initiate connection to consumer , but if bidirectional communication is needed , VCP peering can be used.

Below figure describes, how VPC endpoint service is configured between Service provider and Service Consumer.