AWS PrivateLink | VPC Endpoint Service | Demo
HTML-код
- Опубликовано: 5 авг 2024
- Let's learn AWS PRIVATE LINK in detail, with a hands-on demo where we create a VPC Endpoint service with Network Load balancer ie the Interface Endpoint.
We don't have to make use of any internet gateway, NAT device, public IP address, AWS Direct Connect connection, or AWS Site-to-Site VPN connection to communicate with the service.
The best and the most important thing is to remember that --- Traffic between your VPC and the service does not leave the Amazon network.
and that's why we have mentioned here.
Timelines for your convenience:
00:00 // Intro
01:25 // What is an AWS Private Link?
06:14 // AWS Private link with VPC endpoint service
09:18 // What are the features and benefits of using Private link?
13:23 // Private link with a Hybrid architecture?
14:45 // Hands on Demo
29:00 // Outro
VPC Sessions :
▶ PART 1: What is a VIRTUAL PRIVATE CLOUD? Amazon VPC | Visual Explanations :
• What is a VIRTUAL PRIV...
▶ PART 2: WHAT IS A CIDR IN AWS? | VPC PART 2 | Visual Explanations
• WHAT IS A CIDR IN AWS?...
▶ PART 3: WHAT IS A VPC SUBNET AND HOW TO ASSIGN SUBNETS IN VPC? VPC PART 3 | Visual Explanations
• WHAT IS A VPC SUBNET A...
▶ PART4: AWS SAVINGS PLAN | COMPUTE AND EC2 INSTANCE SAVINGS PLANS | Visual Explanations
• AWS SAVINGS PLAN | COM...
▶ PART5: HOW TO CREATE VPC and SUBNET | HANDS-ON DEMO
• HOW TO CREATE VPC and ...
▶ PART6: WHAT IS INTERNET GATEWAY? WHAT ARE ROUTE TABLES? WHAT IS PUBLIC SUBNET? | Visual Explanations
• WHAT IS INTERNET GATEW...
▶ PART7: HOW TO PROVIDE INTERNET ACCESS TO INSTANCES AT VPC PRIVATE SUBNET? | NAT GATEWAY | NAT INSTANCE
• HOW TO PROVIDE INTERNE...
▶ PART8: HOW TO CREATE NAT GATEWAY? | HAND ON DEMO
• AWS NAT GATEWAY SETUP ...
▶ PART9: HOW TO CREATE NAT INSTANCE? | HAND ON DEMO
• AWS NAT INSTANCE SETUP...
▶ PART10: VPC DHCP Options Set | AWS Private Hosted Zones | Visual Explanations
• AWS DHCP Options Set |...
▶ PART11: AWS NACL and Security Groups | Ephemeral Ports | Visual Explanations
• AWS NACL and Security ...
▶ PART12: AWS VPC PEERING | Visual Explanation
• AWS VPC PEERING with D...
▶ PART13: AWS VPC ENDPOINT | INTERFACE ENDPOINT | GATEWAY ENDPOINT | Simplified Visually
• AWS VPC ENDPOINT | INT...
▶ PART14: VPC FLOW LOGS | WHAT IS AGGREGATE INTERVAL | Visual Explanations
• VPC FLOW LOGS | WHAT I...
▶ PART15: WHAT IS A BASTION HOST? HOW TO USE BASTION HOSTS? Simplified and Visualized
• WHAT IS A BASTION HOST...
▶ PART16: AWS SITE TO SITE VPN | VIRTUAL PRIVATE GATEWAY | TRANSIT GATEWAY | ACCELERATED SITE TO SITE VPN
• SITE TO SITE VPN | VIR...
▶ PART17: AWS Direct Connect | Direct Connect Gateway | Link Aggregation Group AWS LAG | Visual Explanation
• EP-88 | AWS Direct Con...
▶ PART18: AWS PrivateLink | VPC Endpoint Service | Interface Endpoints | Demo on NLB with PrivateLink
• AWS PrivateLink | VPC ...
Join this channel to get access to perks:
/ @pythoholic
⭐ Kite is a free AI-powered coding assistant that will help you code faster and smarter. The Kite plugin integrates with all the top editors and IDEs to give you smart completions and documentation while you’re typing. I've been using Kite for 6 months and I love it!
www.kite.com/get-kite/?...
🍀 If you wish to support me please choose the links below:
INSTAMOJO : instamojo.com/@pythoholic
PAYPAL : paypal.me/pythoholic
BECOME A MEMBER (PATREON) : / pythoholic
GADGETS I USE : www.amazon.in/shop/pythoholic
AWS Solutions Architect Associate Certification 2020 Playlist:
tinyurl.com/y4lr8zu4
Please follow we in the links below to stay updated: 🙌
🍀Click on the link below to subscribe: tinyurl.com/qqebnwz
🍀Instagram: / pythoholic
🍀Facebook: / bepythoholic
🍀Twitter: / bepythoholic
🍀Discord: / discord
Disclaimer: The content provided in the channel are not affiliated in any way to the organization. We provide information here on the channel based on the knowledge we have on the topic. We advise our viewers to please do their own research and read more about them from the source provided by the organization to get a better outlook on the topic that has been covered.
These videos are just to provide you a platform to learn, and there can be mistakes and we are always trying to improve based on your feedback. we recommend viewers to have an open mind. Please support the channel to get more content like these in the future.
#RoadToAWS #AWSSolutionsArchitectAssociate2020 #Pythoholic 
Наука
Timelines for your convenience:
00:00 // Intro
01:25 // What is an AWS Private Link?
06:14 // AWS Private link with VPC endpoint service
09:18 // What are the features and benefits of using Private link?
13:23 // Private link with a Hybrid architecture?
14:45 // Hands on Demo
29:00 // Outro
Do you know how to create a namespace in cloudwatch?
Instablaster.
Amazing explanation!
Your Likes to Views ratio just tells how great the content is!
All the videos are self explanatory, Very eassy to digest without mental struggle.Amazing work. Please add packet flow or traffic flow like cisco packet tracer flash technique for all the networking .lectures.
I passed my Solutions Architect certification! Thank you for your videos and explanations, they helped me a lot!
Thanks a lot for the support it means a lot to me and I will start off again and will strive to provide better content to you guys
Great content! Better than most similar channels out there. Thanks
Wow !!! Amazed by your explanation. You hit right chord where people has a problem in understanding. Worth watching and highly valuable.
Thanks for the support sir 👍
@@Pythoholic difference between aws private link and direct connect?
Really good video! 👌🏾I realised the NLB wasn’t deleted during the cleanup
Absolutely amazing way of explaining the concepts. Hats off!
Thanks 😊
perfect explanation with fabulous presentation
Man, you are really Awesome ... not an easy job to explain this Interface Endpoint , but you did it. heads up to you... My heartiest wishes to you
Thanks 👍
Very nicely explained, Thanks a lot!
Your content are awesome, I am going through to improve my skills. Thanks
Awesome video and great effort. Thank you bro!
Videos are long but absolutely worth watching
Great, explain so clearly.
Very nicely explained, thank you
Nicely explained ,thank you 🙏😀
The best, keep up doing the good work and I have subscribed :)
very well explained, thanks
Very informative and needed
super super clear, thanks!
Bravo! Fantastic overview and demo. Thank you so much. Everything is simple once you understand it ... and you've made it easy to understand.
Great explanation !!
Crisp ! Bravo.
✅
Great topic and a nice demo. The proof of the pudding is in the eating. You took an effort to cook the pudding, but I think it was not eaten haha.... Only if you had a small Welcome web page as a service on the producer side (of course using some user-data during launch), and tested that "service" with the private IP address given to the Private Service Link on the consumer end, the feast would have been complete. Learned a lot of things today, thanks.
Thats a great feedback and i really appreciate it.
I will surely take this into account and will come up with something as per your suggestion.
Well explained :)
Amazing!
Cleared the exam today , great tutorials, thanks for doing them.
Congratulations 🎉 Priyanka
Please do share and support the channel on other platforms as well like linkedIn.
All the best 🎉🎉
Good explanation
you're amazing !
Amazing Video
Really superb
Good information ....
Good explanation....
Expecting more real example with ec2 hosted apps and access demo.
Sure thanks for the feedback
BEST CONTENT
very nice
excellent
Hi ,Please create new video session for private link using Gateway load balancer. All your videos really awsome. eagerly waiting for private link Gateway loadbalancer video and demo.
Great Video (thanks). Is there a way to connect to the VPC Endpoint with the private DNS (rather than the IP addresses on the endpoint)?
very good articulation and lecture!! How to improve, any tips?
You should check in EC2 whether the connection working or not that will be more helpful
Thanks for the feedback
how to configure the onpremise customer router to connect to the aws direct connect virtual interface?
Gr8 video..but how do u connect from source to destination via endpoint service ? Do we need to do any routing for this or just connect with nlb dns name
What if I want only one way traffic? Meaning I want to connect my test env vpn to prod env vpn? Also what do you suggest what is most secure way an production env vpc should talk with test env vpc?
Thanks for such a detailed visual explanation!
I had a query, in the service provider VPC, do you need to necessarily have EC2 instances behind the NLB? I get that NLB is mandatory, but are EC2 instances mandatory as well?
It actually depends on your use case, When u have a connection between VPC endpoint to NLB, it could be the AWS Service that you can connect to, or it could be a service in AWS market place or your own service in your VPC ie in your EC2 instance
Great video! 2 questions: 1. What is the Network interface that gets automatically created when creating the endpoint? 2. What is the associate with DNS name setting? Can you explain both, please?
thanks for the query ajay. i think i will make a video for this to explain better
This was useful but would have been nice to see you actually make a request to the service.
Hey thanks for the video, I wanted to ask if we can use this to access AWS resources like reading or putting objects within S3? Or is this endpoint mainly to get the initial access to the service and can't be used for resource access?
Here we are creating an access point, but the resource management and its permission are defined by the resource-based policy.
Thanks for the very informative video. Loved it 💕 Could you clarify if this private link can be used for communication in cross region scenarios without need of peering the vpc
let's say you have a service running in one region that needs to access a service running in another region. You can create an AWS PrivateLink endpoint for the service in the second region and configure your first region's VPC to use that endpoint. This allows your service in the first region to securely access the second region service without needing to establish VPC peering between the two regions.
Can someone please share the link for gateway loadbalancer session? Can't find it in Pythoholic's video list. Thank you!
How do you know when you should use private link instead of ENI (Elastic Network Interface)
Explained it well, but In demo session how do you validate the connections. if you can use network diagram with instances, IP subnets and AZs it will help us to relate with diagram to understand the concept.
thanks for the feedback
This, im unable to validate other than Reachability Analyzer.....but I can't ping from Consumer Instance to Service Instance.
what is the next step? I can not attach this network interface to my running EC2 instance, moreover, this network interface has In-use status.
Good
Thanks for the video.
But one thing is missing which I feel is if any services are installed in EC2 VM and accessible using private endpoint DNS that would be more helpful to complete the fulfillment of the video.
Thanks for the feedback I will create another one which covers this
@@Pythoholic but thanks again for your efforts it’s easy to understand which you explained do you have GitHub page where do you have stored image which you created about with two vpc connections with pv link
Your presentations are WOW. what do you use ?
just ppt and adobe
@@Pythoholic I would say awesome skills, I think you should also make video , How to make beautiful presentations😄
I am trying to use VCP endpoint to ECR for web app so that when new instances are created, I don't have to pay for NAT. Do you have an example where VPC endpoint, ECR, ECS and docker based web app deployment are linked together? Appreciate for amazing videos.
Currently I don't have . But sure we can do that. Thanks for the suggestion
Hey
I had a quick question can we still do this with Application load balancers ? or we have to have network load balancers for service endpoint creation at producer end.
As of recent updates, Application Load Balancers do support AWS PrivateLink. You can create an endpoint service in your VPC and specify an ALB as the service provider. This allows you to offer the applications behind your ALB privately to other VPCs through AWS PrivateLink. If there are any specific documentation you can refer i can help you better where they have mentioned dropping support.
Hi, Great explanation. Quick question...in your diagram, provider side, target for network load balancer is instances. For instance, if I am creating an endpoint service for Athena, what should be the target for network load balancer?
When creating an endpoint service in AWS, particularly for a service like Athena which is a serverless, managed service by AWS, you don't typically manage the network load balancers (NLBs) directly. AWS manages the networking layer for Athena, so you don't provision an NLB for Athena in the same way you would for EC2 instances or your own services.
However, if you are integrating Athena with your VPC and you want to create a private connection between your VPC and Athena, you would use AWS PrivateLink. Here's the general idea of how it works, without specifically targeting an NLB for Athena:
1. **AWS PrivateLink**: This service allows you to privately access AWS services like Athena from your VPC, without using public IPs, and without requiring the traffic to traverse the internet.
2. **Endpoint Services**: With AWS PrivateLink, you create an endpoint service in your VPC. This service doesn't directly expose an NLB for you to target; instead, it allows the service provider (in this case, Athena) to accept connection requests.
3. **Interface VPC Endpoints (or Interface Endpoints)**: You create an interface endpoint in your VPC. This is represented as an ENI (Elastic Network Interface) with private IPs in your VPC. This endpoint connects to the endpoint service for Athena, allowing your applications in your VPC to access Athena privately.
4. **DNS Names**: AWS generates DNS names that you can use to reference the Athena service. These DNS names resolve to the private IPs of the interface endpoint, keeping traffic within the AWS network and your VPC.
In summary, instead of targeting an NLB for Athena, you would use AWS PrivateLink to create an endpoint service and an interface endpoint in your VPC. This setup provides private connectivity to Athena, without exposing services to the public internet.
Thanks @@Pythoholic for a quick response. My use case is, we want to access Athena in Account B from Account A. That's why I am exploring endpoint service. I thought of creating an endpoint service for Athena in Account B and use it in Account A. I may be wrong. 😀
Your approach makes sense, and you're on the right track with using AWS PrivateLink to access Athena in Account B from Account A. Here's how you can structure this setup:
1. **Endpoint Service in Account B (Service Provider Account)**:
- In Account B, you create an AWS PrivateLink endpoint service.
- Although Athena itself doesn't have a traditional network load balancer that you would target, you can create an endpoint service for Athena.
- This endpoint service won’t require you to specify network load balancers as targets. Instead, AWS manages the underlying infrastructure.
2. **Permissions**:
- In Account B, you need to set up the appropriate permissions so that Account A can create a connection to the endpoint service.
3. **Interface VPC Endpoint in Account A (Service Consumer Account)**:
- In Account A, you create an interface VPC endpoint (AWS PrivateLink) for the endpoint service that you created in Account B.
- When you create this interface VPC endpoint, you specify the service name of the endpoint service from Account B.
- This doesn't involve setting up traditional targets for a load balancer, but rather, it involves creating a secure, private connection to the service in Account B.
4. **DNS Configuration**:
- After creating the interface endpoint in Account A, you will use the DNS names associated with the interface endpoint to access Athena. The DNS names resolve to private IP addresses in your VPC, keeping the traffic internal and secure.
5. **Testing and Validation**:
- After setting up, test the connectivity and permissions by querying Athena from Account A, ensuring that the query goes through the PrivateLink setup and that the necessary permissions are correctly configured.
This setup leverages AWS PrivateLink for private connectivity and doesn't require you to manage network load balancers for Athena. AWS handles the underlying infrastructure, making sure that your connection between Account A and Athena in Account B is secure and private.
Thanks @@Pythoholic for taking time and explaining all the steps. I still have a doubt in step 1. Creating an endpoint service in account B requires either Network Load Balancer or GLB. It's not allowing to create an endpoint service without selecting one of the load balancer. I may be missing something here.
Hi Pythoholic, could you please explain some of the use cases of endpoint services? I have viewed many courses on endpoint services and once endpoint is created they just curl the ip address of ENI or DNS name and show the default webpage, This cannot be the only use case of it, isn't it?... so could you please explain more use cases like if I want to SSH into instance on service provider's side can I? can I create files on service provider? the way we can do using vpc peering. Thanks !!..............or if you could suggest me some books that will also work.
In real-time it's not only one BU that's works on services there might be Dev team and other teams like security sysops who might host the applications and they would want to collaborate with u when u host a service.
They would need endpoints inorder to work with you and that's where endpoints are helpful
❤
How does PrivateLink differ from VPC Endpoint? Both seem to accomplish the same. When should I choose one over the other?
it depends on ur usecase
osamaoracle.com/2021/08/21/vpc-endpoints-and-aws-privatelink/
how do we test the accessibility of the endpoint in ec2 instance of consumer?
wget? telnet?
Testing the accessibility of an endpoint on an EC2 instance can be done using various methods, with `wget`, `telnet`, `curl`, and `ping` being some of the common ones. The choice depends on what you want to test (just reachability, specific service availability, etc.):
1. **Ping**:
- Use `ping` to check the basic reachability of your EC2 instance.
- Command: `ping `
- Note: ICMP requests must be allowed in your EC2 instance's security group and network ACLs. Some servers disable ICMP/ping responses.
2. **Telnet**:
- Use `telnet` to test the connectivity to a specific port on your EC2 instance. It's useful for checking if a particular service (like SSH, HTTP) is listening on the expected port.
- Command: `telnet `
- Note: If the connection is successful, the port is open. If not, it's either closed, or a firewall is blocking access.
3. **Wget or Curl**:
- Use `wget` or `curl` for testing HTTP or HTTPS endpoints. These tools are more specific for web services and are useful for checking if a web server is serving content.
- Commands:
- `wget `
- `curl `
- Note: These tools can also provide information about the response headers, which can be useful for debugging.
4. **Nmap**:
- Use `nmap` for a more comprehensive scan to see which ports are open and what services are running on those ports.
- Command: `nmap `
- Note: Be cautious with `nmap` as it's powerful and can be intrusive. Ensure you have the proper permissions to use it on the network.
5. **Netcat (nc)**:
- Use `netcat` as an alternative to `telnet` for checking port connectivity. It's also useful for debugging and analyzing the network.
- Command: `nc -vz `
Remember:
- Before testing, ensure that your EC2 instance's security group and network ACLs allow inbound traffic on the ports you're testing.
- Some services might be bound to a specific interface. Make sure the service you're trying to reach is configured to listen on the interface you're connecting to (e.g., publicly accessible).
- For HTTP/HTTPS services, checking the application's logs can also provide insights if you're able to access the instance but are experiencing issues with the service itself.
confused with the difference between VPC peering and AWS direct connect. @pythoholic can you pls clarify. When to choose amongst these services
VPC Peering supports only communication between two VPCs in the same region. You can use Direct Connect to enable communication between VPCs in different regions.
Can It work between two different aws account? like one account serves as consumer and another account serves as provider?
Yes, AWS PrivateLink can work between two different AWS accounts, with one account serving as the consumer and the other account serving as the provider.
AWS PrivateLink enables you to securely access services hosted on AWS privately over the Amazon network. It allows you to establish private connectivity between VPCs (Virtual Private Clouds), VPC endpoints, and AWS services. This private connectivity ensures that traffic remains within the AWS network and does not traverse the public internet.
When it comes to cross-account connectivity, you can set up AWS PrivateLink in a way that allows a consumer account to access services provided by a different account. The provider account would host the service or resource, and the consumer account would establish a VPC endpoint to connect to that service.
Here's a high-level overview of the steps involved:
1. Provider Account:
- Create and configure the service or resource that you want to expose to other AWS accounts.
2. Consumer Account:
- Create a VPC endpoint in the consumer account's VPC, specifying the provider's service and the provider's account ID.
- Ensure that appropriate route tables and security groups are set up to allow traffic to flow between the consumer VPC and the provider service.
3. Testing and Access:
- Once the VPC endpoint is established, resources within the consumer account's VPC can access the provider's service or resource using private IP addresses. The traffic between the consumer and provider remains within the AWS network, offering enhanced security and performance.
By leveraging AWS PrivateLink and establishing VPC endpoints between different AWS accounts, you can achieve secure and private connectivity for services across accounts, enhancing data protection and minimizing exposure to the public internet.
It's important to note that both the consumer and provider accounts must have the necessary permissions and configurations in place to enable cross-account communication and establish VPC endpoints.
Can we do the same with ALB as well or it needs to be NLB ?
Dint understand the context please if you could clarify which section.
Interface Endpoint -> Network Load Balancer + AWS Service
Gateway Load Balancer Endpoint -> Gateway Load Balancer + Appliance
Gateway Endpoint -> Access to S3/DynamoDB securely
AWS REALLY needs to find someone who can name their products in a simple, non confusing way...
Thats a genuine concern
What if the AWS service we want to doesn't have a service endpoint in the same region? Can we use our VPC Interface endpoint in us-east-1 to communicate with a service whose VPC service endpoint is in us-west-1? Is cross region communication possible? If I'm not wrong VPC Peering does allow cross region communication but interested to know about VPC PrivateLink
yes it is
please check this link : aws.amazon.com/premiumsupport/knowledge-center/vpc-endpoints-cross-region-aws-services/
and for private link as well aws.amazon.com/about-aws/whats-new/2018/10/aws-privatelink-now-supports-access-over-inter-region-vpc-peering/
Can you please demo of vpc endpoint service to rds
Sure will keep this point and will make a video on this 👏
I am getting confused here. Since AWS privateLink is already the best solution to talk between two VPCs. What is the point for VPC peering then? So the only strength for VPC peering is to save the money by without paying to the third party then. Please correct me if I am wrong. Thanks
It depends on your use case, if you are trying to expose a service endpoint to your user or you want to connect 2 vpcs. Please refer to this link: support.huaweicloud.com/intl/en-us/vpcep_faq/vpcep_04_0004.html
@@Pythoholic Thanks a lot
One thing i wanted to see was what rules are given to the firewall attached to the vpc endpoint, you didn't bother to show that, I wonder when I act as a consumer, do I need to give firewall rules in the security group attached to the endpoint?
thanks for the feed back and actually for just the course we can cover as per the requirements, if we provide all details it will be come too much for members who are new. we can iterate on them in upcoming videos
No it isn't. Just kidding. Thanks for the amazing explanation.
If one of the service in our vpc say ec2 want to connect with s3 using private link.Then it case do we need to create an IAM role for ec2 to connect to s3 after reaching to s3 using private link.
When you use a VPC Endpoint (specifically for S3), it allows your EC2 instance to connect to S3 without traversing the public internet. The VPC Endpoint provides a direct, private connection between your VPC and the supported AWS service (in this case, S3).
However, the VPC Endpoint only handles the network connectivity aspect. It does not grant permissions to perform actions on S3. For that, you still need IAM roles or IAM user credentials.
So, if an EC2 instance in your VPC wants to access an S3 bucket, you would typically:
1. Create a VPC Endpoint for S3 to ensure private connectivity.
2. Attach an IAM role to the EC2 instance with the necessary permissions to access the S3 bucket.
In summary, even after setting up a VPC Endpoint for S3, you still need to create and assign an IAM role to your EC2 instance to grant it permissions to access and perform actions on S3.
@@Pythoholic ThankYou So Much for such a great explaination. Will that case be used for all the other services as well who are going to be connected with each other in that case also we need to create an IAM role ?
Yes, the principle applies to other AWS services as well. The VPC Endpoint (or PrivateLink) primarily addresses the network connectivity aspect, ensuring that traffic between your VPC and the AWS service does not traverse the public internet.
However, the VPC Endpoint does not handle permissions. For permissions, you still rely on AWS Identity and Access Management (IAM).
For example, if you have an EC2 instance in your VPC that wants to access an RDS database, a DynamoDB table, or any other AWS service:
1. You can create a VPC Endpoint for that specific service to ensure private connectivity.
2. You still need to attach an IAM role to the EC2 instance (or use IAM user credentials) with the necessary permissions to access that specific AWS service.
In summary, regardless of the AWS service you're connecting to, if you're using a VPC Endpoint for private connectivity, you'll still need IAM to manage permissions and access controls.
@@Pythoholic Hello ! Is Vpc Endpoint with respect to aws and private endpoint with respect to azure is same ?
The approach might be different but the underlying concept is same. In concept, AWS VPC Endpoints and Azure Private Endpoints serve similar purposes: they both allow you to privately access services within their respective cloud environments without traversing the public internet. However, there are some differences in implementation and features:
### AWS VPC Endpoints:
1. **Types**: Two types - Gateway Endpoints and Interface Endpoints.
2. **Services Supported**: Limited to specific AWS services like S3, DynamoDB for Gateway Endpoints, and various others for Interface Endpoints.
3. **Networking**: Operates within a VPC (Virtual Private Cloud).
4. **DNS**: Custom DNS names are not typically provided; you use service-specific DNS endpoints.
5. **Pricing**: Charged based on the data processed.
### Azure Private Endpoints:
1. **Types**: One general type that can be used for multiple Azure services.
2. **Services Supported**: Broad range of Azure services and also supports Azure Load Balancer.
3. **Networking**: Operates within a VNet (Virtual Network).
4. **DNS**: Provides a private IP and a custom DNS name.
5. **Pricing**: Generally charged based on the number of private endpoints.
So while they aim to solve the same problem, the way they go about it can differ.
clear explanation, isn't it?
Whats if the consumer is has a different AWS account? and is that accessible from other account VPC?
The thing is to connect to VPC to access resources
It could be from ur account or from other account, that's not a problem.
@@Pythoholic Do the accounts need to be under the same Organization for PrivateLink to work between two accounts?
As per my understanding it's used to share resources within the organisation but if there is a term for resource sharing with third-party organisation I need to check that, I haven't come across that situation
Ok. I'm watching the video right now 👍
I wish you could have added an example of the consumer actually consuming the service. For example you created the NLB pointing to an EC2 instance, but you never showed that the link was indeed working. an accepted connection might not necessarily means that the traffic will flow from one side to another.
Thanks for the feedback. I will surely update it
presentation was great but yes showing the end-to-end connectivity is important, im currently struggling to getting the end-to-end connectivity to work via deployment method Terraform.
@@Armurp01 if it helps, you need to use one of the dns provided in the VPC endpoints (vpc -> endpoints -> details -> dns names. Use any of the ones provided) in order to reach the service. You prob are using the nlb dns for it expecting for it to work but it might not.
@@CardenasSimon yes im just trying to ping the Service Instance IP from Consumer Instance IP.....figured DNS wouldn't be needed since its just a Private IP Address
how you call the vpc endpoints, there is no demo for it,, not clear,
It's there on the channel
Please visit the AWS solutions architect playlist. ruclips.net/video/CMrFIv3a29w/видео.html
@@Pythoholic we need to use the endpoint servicename to connect the service from other vpc ?
First we create the endpoint service and make it available for consumers and then from the consumer side we create the interface endpoint to connect to that.
while creating the interface endpoint we provide the “service endpoint” dns
what if I want to create a private DNS name?
Make use of route 53
@@Pythoholic done
The service Provider can provide a private DNS name for the endpoint service name however the name must be verified. AWS Private Link docs provide instructions how to do it.
How can we use AWs private link with AWs EKS.I have created a NLB which can talk to endpoint service. How should I proceed further ?
Using AWS PrivateLink with Amazon EKS (Elastic Kubernetes Service) involves creating an interface VPC endpoint for your services running on EKS, so they can be accessed privately within your VPC or from other VPCs. Since you've already created a Network Load Balancer (NLB) that can communicate with the endpoint service, you're partway there. Here's how you can proceed further:
1. **Create an Endpoint Service Configuration**:
- Navigate to the VPC Dashboard in the AWS Management Console.
- Go to the "Endpoint Services" section and create a new endpoint service.
- Select your NLB as the service load balancer. This will make the Kubernetes services, which are exposed via the NLB, available as an endpoint service.
2. **Create a VPC Endpoint**:
- Still in the VPC Dashboard, go to the "Endpoints" section.
- Create a new Interface VPC Endpoint.
- Choose the service name of the endpoint service you just created.
- Select the VPC and subnets where you want the endpoint to be accessible.
- Security groups attached to your VPC endpoint should allow traffic to the port your EKS service is running on.
3. **Configure DNS if Necessary**:
- By default, AWS provides a DNS hostname for the endpoint.
- If you require a custom DNS name, you might need to create a private hosted zone in Route 53 and associate it with your VPC.
4. **Update Your Application or Clients**:
- Modify your application or clients to use the new VPC endpoint to communicate with the EKS service. This ensures that traffic between your VPC and the EKS service does not traverse the public internet.
5. **Verify Connectivity**:
- Test the connectivity to ensure that your setup is correctly configured and that your EKS services can be accessed via the VPC endpoint.
6. **Monitor and Log**:
- Consider enabling VPC Flow Logs for your VPC endpoint to monitor and log the traffic that is reaching your EKS services.
- Regularly check CloudWatch metrics and logs to ensure the health and performance of your services.
By using AWS PrivateLink, you're enhancing the security of your architecture by ensuring that the traffic between your services and EKS does not go over the public internet. This setup is beneficial for compliance and can reduce the exposure of your services to potential threats.
@Pythoholic Thank you so much for the detailed approach, I have created an endpoint, slightly confused on how should I test my connectivity now? I have created an nginx deployment whose service is an NLB which is connected to AWS private link and that is connected to endpoint. How should I test the flow ?
Testing the connectivity in your setup involves ensuring that your Nginx deployment is reachable through the AWS PrivateLink you've set up. Here’s how you can test the flow step by step:
1. **Identify the DNS Name or IP of the Endpoint**:
- After creating your VPC endpoint connected to the AWS PrivateLink, AWS provides a DNS hostname for the endpoint. You can find this in the VPC dashboard under the 'Endpoints' section. Note down the DNS name.
2. **Test Using a Client Within the Same VPC**:
- If you have an EC2 instance or any other resource within the same VPC as the endpoint, you can test the connectivity from that resource.
- Use a tool like `curl` to send a request to the Nginx service:
```
curl
```
- You should receive the default Nginx welcome page or the content you've configured Nginx to serve.
3. **Test From a Different VPC (If Setup for Cross VPC Access)**:
- If your VPC endpoint is configured to be accessible from other VPCs, you can test it from a resource in another VPC.
- The security group of the endpoint and the route tables in both VPCs should allow the traffic.
4. **Check Security Groups and Network ACLs**:
- Ensure that the security groups attached to your endpoint allow inbound traffic on the port Nginx is listening on (usually port 80 for HTTP or 443 for HTTPS).
- Also, check the network ACLs for any rules that might be blocking the traffic.
5. **Access Logs or Monitoring Tools**:
- If you have access logs enabled for your Nginx service or if you're using monitoring tools, check them to see if they register the requests. This can provide clues in case the connectivity test fails.
6. **Troubleshooting**:
- If you're not getting the expected response, verify that your Nginx service is running correctly and is configured to respond to requests on the NLB's listener port.
- Double-check the configuration of your NLB and ensure it's correctly forwarding requests to your Nginx pods.
Remember, testing network connectivity can sometimes involve trial and error, especially with complex architectures. If the initial test doesn't work, review each component's configuration to ensure they're correctly set up to communicate with each other.
@@Pythoholic Again, thanks a ton for your help. I was clueless before. The thing m blocked now is I am unable to understand the subnets and security grp settings while creating Endpoint.
I am able to see the az in which there are public, private and eks private subnets which one should I select for the creation of endpoint. My gut feeling says it should be either private or eks private but it is getting confusing.
On the security grp, should I create a new security grp or use the existing ones from the VPC ? and for the route I know the port of my service but what should I put in the source?
You're on the right track thinking about using either private or EKS private subnets for your endpoint, and your considerations about security groups are also crucial. Let's break down these decisions to clarify your options:
### Subnets for Endpoint Creation
When you create an endpoint for AWS PrivateLink, the general recommendation is to place it in **private subnets**. This ensures that the traffic to and from your endpoint does not traverse the public internet, aligning with the purpose of using PrivateLink for secure, private connectivity.
- **Private Subnets**: These are not directly accessible from the internet, making them a secure choice for your endpoints. They allow your services to communicate with the endpoint without exposing them to the public internet.
- **EKS Private Subnets**: If you have dedicated subnets for EKS that are private, these are also a good choice, especially if your EKS clusters are the primary consumers of the service exposed via PrivateLink. This setup minimizes internal network latency and keeps traffic within the AWS backbone.
Choosing between private and EKS private subnets often comes down to your network architecture and where the consumers of the PrivateLink service are located. If the primary consumers are within your EKS clusters, EKS private subnets are ideal.
### Security Group Settings
Security groups act as a virtual firewall for your resources to control inbound and outbound traffic. When configuring a security group for your endpoint:
- **Create a New Security Group**: If you want to have specific rules that apply only to the endpoint, creating a new security group is advisable. This allows you to tailor the rules to the specific needs of the endpoint without affecting other resources.
- **Use Existing Security Groups**: If your existing security groups already define the necessary rules for the endpoint traffic, you can reuse them. This approach is simpler but ensure that the rules in the existing security group are appropriate for the endpoint.
### Route Table and Source Port Configuration
When setting up the endpoint, you'll specify the VPC and subnets, but typically, you won't modify the route table directly for the endpoint itself. AWS manages how the endpoint routes traffic to your services. Your focus should be on configuring the security group rules correctly:
- **Port Configuration**: Ensure that the security group associated with your endpoint allows inbound traffic on the port your service is using. For example, if your service is listening on port 80, you should allow inbound traffic on port 80.
- **Source for Security Group Rules**: The source in your security group rules depends on who will be accessing the service through the endpoint.
- If the access is from within the same VPC, you can specify the VPC's CIDR or the specific subnet CIDRs as the source.
- If the access is from other VPCs (in case of VPC Peering or if shared across accounts via Resource Access Manager), specify the CIDR ranges of those VPCs or use security groups from those VPCs as the source, if supported.
By carefully choosing your subnets and configuring your security group, you ensure that your AWS PrivateLink setup is secure, efficient, and tailored to your application's needs.
Isn't it ?
hahah .. got em !!
Nice tutorial isn't it ?
I see what u did there 🤣.
Your demo didn't even show how a consumer can use the vpc endpoint to reach the service
i will make another one. thanks for the feedback
Very nicely explained, Thank you!!