An application in a private subnet retrieves a secret from Secrets Manager.
The request must not traverse a NAT Gateway or the public internet.
Which design is most appropriate?
Create an Interface VPC Endpoint for Secrets Manager so the application reaches the service through private IP addresses inside the VPC.
Detailed explanation
Embedding a long-lived secret in an image increases the chance of disclosure and complicates rotation.
Embedding a long-lived secret in an image increases the chance of disclosure and complicates rotation.
An interface endpoint creates elastic network interfaces with private IP addresses for private service access.
An interface endpoint creates elastic network interfaces with private IP addresses for private service access.
DNS naming alone does not provide a private network path to Secrets Manager.
DNS naming alone does not provide a private network path to Secrets Manager.
Secret retrieval does not require exposing the database or application to the internet.
Secret retrieval does not require exposing the database or application to the internet.
Check official documentation
Compare the following points with the official documentation.
AWS PrivateLinkとSecrets Manager Interface Endpointの公式説明を確認する。
What to confirm
プライベートサブネットからAWSサービスへVPC Endpointで接続できる。
Key points
- Interface VPC Endpoint
- AWS PrivateLink
- Private service path
Notes
- Environment: AWS公式VPC・Secrets Managerドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Private service access
An interface endpoint keeps the request inside the VPC path while the workload role controls which secret may be read.
Network path versus authorization
The endpoint supplies connectivity; IAM and the secret resource policy still decide whether access is allowed.