AWS PrivateLink share

0

Hi Team - I recently came across below blog and have one query on "Scenario 3: Connecting with third-party vendors using AWS PrivateLink"

https://aws.amazon.com/blogs/networking-and-content-delivery/connecting-vpcs-securely-and-at-scale-to-3rd-party-public-services-in-on-premises-networks/

Scenario 3 says,

Use the PrivateLink Endpoint in VPC A and allow applications in other VPCs to talk to that endpoint through the Transit Gateway.

Wanted to understand, how VPC B and VPC C use the Private Link endpoint created in VPC A to communicate to third party service ? Do we have any other better documentation apart from "https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-aws-transit-gateway-with-aws-privatelink-and-amazon-route-53-resolver/"

JD
asked 10 months ago478 views
2 Answers
1

Hello, as I understood, the main idea is to resolve in your SpokeVPC DNS name of the PrivateLink endpoint created in the main VPC. It is done by sharing Route53 resolvers from the main VPC to your Spoke VPCs. (https://repost.aws/knowledge-center/route-53-share-resolver-rules-with-ram)

Let's presume you have main VPC (10.0.0.1/16) where SNS endpoint is created.

  1. It has DNS name sns.us-east-1... and IP address 10.0.0.23. You have Spoke VPCs:
  • Spoke VPC1 (172.0.0.1/16)
  • Spoke VPC2 (172.0.0.2/16)
  1. You share the DNS name across spoke VPCs, that means that DNS server in Spoke VPC1/VPC2 will resolve sns.us-east-1. to 10.0.0.23.
  2. TransitGateway will route your requests from spoke VPCs to 10.0.0.23 to the main VPC where PrivateLink is deployed.

Can be multi-regional as well https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/centralized-access-to-vpc-private-endpoints.html

answered 10 months ago
  • Thanks for the details

0
Accepted Answer

Hello.
The following documents would be relevant.
This section describes the flow of communication from SpokeVPC to HubVPC's VPC endpoints using Transit Gateway.
https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/privately-access-a-central-aws-service-endpoint-from-multiple-vpcs.html

profile picture
EXPERT
answered 10 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions