VPC endpoint while working on a shared resources from a master account

Question

HI there,

I am trying to create a private link (VPC endpoint to allow private traffic between my logstash agent and elastic SAAS service).
Both of course are deployed in the same AWS region and therefore the intention is to optimize cost from network traffic.

Now while following these guide https://www.elastic.co/guide/en/cloud/current/ec-traffic-filtering-vpc.html#ec-aws-vpc-overlapping-azs which seems to be the right steps to me, with one minor caveat in one step which has been dealt with the elastic team.

Given the facto I did not find the VPC endpoint in the list of resources to share with the child account, I am not sure whether this newly created VPC Endpoint does effective take place when an EC2 created on the respective subnet from the child account has full right or permission to send traffic through the VPC endpoint created by the parent account? 
I a assuming that as it is a the network level and by not finding the VPC endpoint to shared within Resource Manager this is all granted by given that nature if this subject I would appreciate AWS confirming this to me.

Thank you very much.
Best REgards,
Manuel Chouza

re:Post Agent · Answer

When working with shared VPC resources from a master account, creating and using VPC endpoints can indeed be a bit complex. In the scenario you've described, where you're trying to create a private link (VPC endpoint) to allow private traffic between your Logstash agent and Elastic SaaS service, there are a few important points to consider:

1. VPC endpoints are subnet-level resources and cannot be directly created by a participant (child) account in shared subnets. Only the VPC owner (master account) can create VPC endpoints.

2. However, if the VPC endpoint is created by the master account in the shared subnet, it will be available for use by all participant accounts that have access to that subnet.

3. You are correct in noting that VPC endpoints are not listed as a shareable resource in AWS Resource Access Manager (RAM). This is because the sharing of VPC endpoints is implicit when the subnet is shared.

4. When an EC2 instance is launched in a shared subnet by a participant account, it will have access to any VPC endpoints created in that subnet by the master account. The routing for the VPC endpoint is handled at the subnet level, so any resources within the subnet can utilize it.

5. You don't need to explicitly share the VPC endpoint or grant additional permissions for the EC2 instance in the child account to use it. As long as the instance is in the shared subnet where the VPC endpoint exists, it will be able to route traffic through that endpoint.

Given this information, if you've created the VPC endpoint in the master account within the shared subnet, your EC2 instance in the child account should be able to use it for private communication with the Elastic SaaS service. The network-level integration happens automatically due to the shared subnet architecture.

To ensure everything is working as expected, you may want to:
1. Verify that the VPC endpoint is correctly configured in the master account.
2. Check that the security groups and network ACLs allow the necessary traffic.
3. Test the connection from your EC2 instance to confirm that traffic is indeed routing through the VPC endpoint.

If you encounter any issues, you may need to coordinate with the master account administrator to troubleshoot or make any necessary adjustments to the VPC endpoint configuration.  
**Sources**  
[OpenSearch Service, Unable to create VPCe collection with a Shared Subnet | AWS re:Post](https://repost.aws/questions/QUpUZpolC5S5eiLBX6kgQvtA/opensearch-service-unable-to-create-vpce-collection-with-a-shared-subnet)  
[Mastering AWS VPC: A Comprehensive Guide to Building Secure and Scalable Networks | AWS re:Post](https://repost.aws/articles/AR3hlIVmDnTq2FYib6jgACUA/mastering-aws-vpc-a-comprehensive-guide-to-building-secure-and-scalable-networks)

VPC endpoint while working on a shared resources from a master account

Add your answer

Relevant content