AWS PrivateLink share

Question

Hi Team - I recently came across below blog and have one query on ***"Scenario 3: Connecting with third-party vendors using AWS PrivateLink"***

https://aws.amazon.com/blogs/networking-and-content-delivery/connecting-vpcs-securely-and-at-scale-to-3rd-party-public-services-in-on-premises-networks/

Scenario 3 says, 
> Use the PrivateLink Endpoint in VPC A and allow applications in other VPCs to talk to that endpoint through the Transit Gateway.

Wanted to understand, how VPC B and VPC C use the Private Link endpoint created in VPC A to communicate to third party service ?  Do we have any other better documentation apart from "https://aws.amazon.com/blogs/networking-and-content-delivery/integrating-aws-transit-gateway-with-aws-privatelink-and-amazon-route-53-resolver/"

Accepted Answer

Hello.  
The following documents would be relevant.  
This section describes the flow of communication from SpokeVPC to HubVPC's VPC endpoints using Transit Gateway.  
https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/privately-access-a-central-aws-service-endpoint-from-multiple-vpcs.html

Answer

Hello, as I understood, the main idea is to resolve in your SpokeVPC DNS name of the PrivateLink endpoint created in the main VPC.
It is done by sharing Route53 resolvers from the main VPC to your Spoke VPCs. 
(https://repost.aws/knowledge-center/route-53-share-resolver-rules-with-ram)

Let's presume you have main VPC (10.0.0.1/16) where SNS endpoint is created.
1. It has DNS name sns.us-east-1... and IP address 10.0.0.23.
You have Spoke VPCs:
- Spoke VPC1 (172.0.0.1/16) 
- Spoke VPC2 (172.0.0.2/16)
2. You share the DNS name across spoke VPCs, that means that DNS server in Spoke VPC1/VPC2 will resolve sns.us-east-1. to 10.0.0.23.
3. TransitGateway will route your requests from spoke VPCs to 10.0.0.23 to the main VPC where PrivateLink is deployed.

Can be multi-regional as well https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/centralized-access-to-vpc-private-endpoints.html

AWS PrivateLink share

Relevant content