How do I configure cross-Region Amazon VPC interface endpoints to access AWS PrivateLink resources?

Resolution

Configure native cross-Region connectivity

Use AWS PrivateLink to configure native cross-Region access for services that use Network Load Balancer, or Gateway Load Balancer. For instructions on configuring cross-Region endpoints for services with AWS PrivateLink, see Introducing Cross-Region Connectivity for AWS PrivateLink.

Use Amazon VPC interface endpoints to access a service that runs in another Region

Complete the following steps:

1. From the consumer Amazon VPC, create an interface endpoint for the required service in a private subnet.
2. Create an inbound security group rule that allows traffic from the remote consumer Amazon VPC CIDR block.
3. Create an inter-region Amazon VPC peering connection between the consumer Amazon VPC and the source Amazon VPC. Configure the interface endpoint in the same AWS Region as the endpoint service.
   Note: An endpoint service is available in the Region where you created it.
4. Use the Amazon VPC peering connection to configure the subnet route tables to route traffic to the remote consumer Amazon VPC in the other Region.

Resolve a service endpoint DNS name from a peered Amazon VPC

To resolve a service endpoint DNS name to private IP addresses from a peered Amazon VPC, create a private hosted zone, and then complete the following steps:

1. Create an interface endpoint for the service.
   Note: Don't configure a private DNS name for your endpoint service.
2. Use the service domain name to create a private hosted zone in Amazon Route 53. Use the AWS account that you used to create the interface endpoint in the previous step.
3. Confirm that you activated DNS hostnames and DNS resolution for both Amazon VPCs in the peering connection.
4. Use Amazon Route 53 to create an alias record that points the service domain name to the Regional endpoint of the interface endpoint DNS. For information about the values that you specify for your alias record, see Values that you specify when you create or edit Amazon Route 53 records.
5. Associate the source Amazon VPC to the private hosted zone. If you created the Amazon VPC with a different account, then follow the instructions at How do I associate a Route 53 private hosted zone with a VPC on a different AWS account?

Related information

How do I use an interface Amazon VPC endpoint to resolve default service domain names?

Why can't I resolve domain names over my VPC peering connection?