A SaaS service must be available from many customer VPCs.
Do not connect the customer VPCs to one another; provide private access only to the service.
Which method is most appropriate?
Publish an Endpoint Service with AWS PrivateLink so each customer VPC can create a private endpoint without a full VPC mesh.
Detailed explanation
The number of connections and routes grows with each customer and creates unnecessary interconnection.
The number of connections and routes grows with each customer and creates unnecessary interconnection.
DNS naming does not create the network path required to reach a service.
DNS naming does not create the network path required to reach a service.
Public access does not satisfy the private-connectivity requirement and broadens exposure.
Public access does not satisfy the private-connectivity requirement and broadens exposure.
PrivateLink provides private service access while keeping provider and consumer VPCs separately controlled.
PrivateLink provides private service access while keeping provider and consumer VPCs separately controlled.
Check official documentation
Compare the following points with the official documentation.
AWS PrivateLink Endpoint Serviceの公式説明を確認する。
What to confirm
サービス公開とVPC相互接続の違いを説明できる。
Key points
- AWS PrivateLink
- Endpoint Service
- Consumer VPC
Notes
- Environment: AWS公式PrivateLinkドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Service publishing
PrivateLink publishes one service boundary while keeping provider and consumer network ownership separate.
Connection topology
A hub-like service endpoint avoids the connection growth of a full mesh.