AWS Marketplace Metering service integration with AWS PrivateLink
We have an AWS Marketplace container product buyer, deploying to ECS Fargate on VPC private subnets. They do not have public subnets and are not permitted to directly access the Internet from their subnets, so they do not have the option to use Internet Gateway, Egress-only Internet Gateway or NAT Gateway.
The most natural option would be to create a VPC Endpoint for the AWS Marketplace Metering service, and attach it to the VPC private subnets used by their ECS Fargate deployment, but this is not (yet?) supported by the AWS Console, nor listed as service supported by AWS PrivateLink in the docs - https://docs.aws.amazon.com/vpc/latest/privatelink/aws-services-privatelink-support.html
Given that an AWS Marketplace Metering service request to RegisterUsage is required for billing to initiate on ECS container startup, how can that be achieved when the buyer deploys to ECS Fargate on VPC private subnets with no access to the public Internet?
One option to unblock the AWS Marketplace buyer is to setup a custom VPC Endpoint Service that proxies access via the public Internet to AWS Metering Service, then having the buyer connect to that over AWS PrivateLink using a VPC Endpoint in their VPC where they have deployed the AWS Marketplace container product in ECS Fargate on private subnets.
Unfortunately, this workaround is still far from the desired goal of reaching AWS Marketplace Metering service without traversing the public Internet, and also introduces further complexity especially if the buyer needs to deploy the VPC Endpoint Service proxying access to AWS Marketplace Metering service themselves to take full ownership of the deployment in production for example.
The buyer's requirement to deploy ECS Fargate on private subnets can be addressed by adding the AWS Marketplace Metering service to the list of services integrated with AWS PrivateLink.
This would be by far the simplest approach for all AWS Marketplace sellers with container products to recommend to their buyers who need to deploy on private subnets. 😀
We would like to request AWS Marketplace Metering service integration with AWS PrivateLink to simplify this for everyone please. 🙏
- Language
- English
asked a year ago271 views
- Newest
- Most votes
- Most comments
When deploying AWS Marketplace container products on ECS Fargate in private subnets without internet access, accessing the AWS Marketplace Metering service presents a challenge since it currently doesn't support VPC Endpoints through AWS PrivateLink.
For this scenario, there are a few potential approaches:
-
Use AWS PrivateLink with existing supported services: While the AWS Marketplace Metering service itself doesn't have a dedicated VPC endpoint, you could leverage other AWS services that do support PrivateLink. Common VPC endpoints used with ECS services include Amazon ECR, S3, DynamoDB, and the ECS service itself. However, this doesn't directly solve the Marketplace Metering service access issue.
-
VPC Endpoint Service proxy solution: As you mentioned, setting up a custom VPC Endpoint Service that proxies access to the AWS Marketplace Metering service is a potential workaround. This would allow the container to communicate with the Metering service without directly accessing the public internet. However, this adds complexity to the deployment and still involves internet traffic at some point.
-
AWS PrivateLink for specific services: If your application needs to access other AWS services beyond Marketplace Metering, you could set up VPC endpoints for those specific services. This would reduce the overall need for internet access, though it doesn't solve the core issue with the Metering service.
The lack of a direct VPC endpoint for AWS Marketplace Metering service is indeed a limitation for customers who need to deploy in private subnets without internet access. Adding AWS Marketplace Metering service to the list of services integrated with AWS PrivateLink would be the most straightforward solution for this use case.
Until such support is available, the proxy approach you described might be the most viable option, despite its complexity. Alternatively, you might need to work with the customer to determine if a limited exception to their networking policies could be made specifically for the Marketplace Metering service traffic.
Sources
Community | VPC Endpoints: an alternative to NAT Gateway
Connecting to AWS services from inside your VPC - Amazon Elastic Container Service
answered a year ago
Relevant content
asked 2 years ago
- AWS OFFICIALUpdated 6 months ago
