Applications in private subnets call Secrets Manager, Systems Manager, and KMS.
Reduce NAT Gateway processing and use private service paths.
Which design is most appropriate?
Create Interface VPC Endpoints for the required AWS services so the private subnets can reach them without routing every request through NAT.
Detailed explanation
Lifecycle rules manage S3 objects and do not change the network path or API processing charge.
Lifecycle rules manage S3 objects and do not change the network path or API processing charge.
Interface endpoints provide private connectivity to supported AWS APIs and reduce NAT processing for that traffic.
Interface endpoints provide private connectivity to supported AWS APIs and reduce NAT processing for that traffic.
Private DNS can resolve names but does not by itself create an AWS service network path.
Private DNS can resolve names but does not by itself create an AWS service network path.
This conflicts with private-subnet isolation and does not use service-specific private paths.
This conflicts with private-subnet isolation and does not use service-specific private paths.
Check official documentation
Compare the following points with the official documentation.
AWS PrivateLink Interface Endpointの公式説明を確認する。
What to confirm
AWSサービスごとのInterface EndpointとNAT経路を比較できる。
Key points
- Interface VPC Endpoint
- NAT Gateway
- AWS service API
Notes
- Environment: AWS公式VPCドキュメントの確認
- Confirm current AWS pricing and service behavior in the official documentation.
Foundation review
Private path
An interface endpoint can keep API requests inside VPC networking and reduce NAT processing.
Connectivity versus naming
A private hosted zone can resolve names, but an endpoint is what supplies the service path.