11.4 Private Network Connectivity & Isolation with AWS PrivateLink & VPC Endpoints

Private Network Connectivity & Isolation with AWS PrivateLink & VPC Endpoints

Security best practices require that enterprise data lakes, data warehouses, and ETL processing clusters operate within completely isolated network environments. Traffic between compute nodes (EMR, EC2, Glue) and storage engines (S3, Redshift, DynamoDB) must never traverse the public internet. AWS Virtual Private Cloud (VPC) Endpoints and AWS PrivateLink provide private, secure connectivity to AWS services and external SaaS applications entirely within the AWS global network backbone.

---

Gateway VPC Endpoints vs Interface VPC Endpoints

Understanding the fundamental architectural and pricing differences between Gateway Endpoints and Interface Endpoints is mandatory for the DEA-C01 exam:

---

Gateway VPC Endpoints for S3 & Data Exfiltration Prevention

To configure a Gateway VPC Endpoint for S3:

1. Create the endpoint specifying the target VPC and S3 service identifier (com.amazonaws.us-east-1.s3).
2. Attach the endpoint to the private subnet Route Tables.
3. The AWS network automatically injects a prefix list route directing all S3 traffic directly to the private AWS network backbone.

[ Private Subnet EC2 / EMR ] --> [ Route Table: Pl-63a5400a -> vpce-12345 ] --> [ AWS Backbone ] --> [ Amazon S3 ]

Data Exfiltration Prevention via Gateway Endpoint Policies

Without an Endpoint Policy, a compromised EC2 instance in a private subnet could upload sensitive corporate data to a malicious actor's personal S3 bucket. A VPC Endpoint Policy enforces resource restrictions at the network layer:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RestrictAccessToCorporateBucketsOnly",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::corporate-data-lake-prod",
        "arn:aws:s3:::corporate-data-lake-prod/*"
      ]
    }
  ]
}

A request routed through this endpoint to an unlisted bucket is blocked even if the application has broad IAM permissions. Pair the endpoint policy with route, egress, bucket-policy, and Organizations controls because it does not govern traffic that bypasses the endpoint.

---

Interface VPC Endpoints (AWS PrivateLink)

Interface VPC Endpoints deploy private Elastic Network Interfaces (ENIs) into chosen availability zones inside your private subnets. Private DNS names map standard AWS service endpoints (e.g., kms.us-east-1.amazonaws.com) directly to the ENI's private IP addresses (10.0.1.50).

Essential Interface Endpoints for Private Data Pipelines

When deploying AWS Glue ETL jobs or EMR clusters inside a completely private subnet (without NAT Gateway or Internet Gateway), you MUST create Interface VPC Endpoints for all dependent services:

1. com.amazonaws.region.kms: Required for KMS key decryption during data processing.
2. com.amazonaws.region.glue: Required for AWS Glue Data Catalog metadata queries.
3. com.amazonaws.region.logs: Required for pushing CloudWatch logs.
4. com.amazonaws.region.kinesis-streams: Required for private real-time stream ingestion.

---

AWS PrivateLink for Custom Cross-VPC Data Services

AWS PrivateLink also allows enterprise architectures to share data microservices or data ingestion APIs across different AWS accounts and VPCs without establishing complex VPC Peering or Transit Gateway routing tables.

[ Consumer VPC (Account A) ]                                [ Service Provider VPC (Account B) ]
  Private Subnet                                               Private Subnet
  [ Interface Endpoint ] <=== PrivateLink AWS Backbone ===> [ Network Load Balancer (NLB) ]
                                                                      |
                                                                      v
                                                             [ Data Ingestion API / EKS ]

How PrivateLink Provider Services Work:

1. The service provider exposes their data ingestion microservice behind a Network Load Balancer (NLB).
2. The provider creates an Endpoint Service configuration referencing the NLB.
3. The consumer account creates an Interface VPC Endpoint pointing to the Endpoint Service.
4. Traffic flows unidirectionally from consumer to provider over the private AWS backbone, completely isolated from IP overlapping conflicts.

---

Network Isolation Design Patterns for AWS Data Services

1. Amazon EMR in Private Subnets

• EC2 instances run in private subnets with no public IPs.
• Security groups block all inbound traffic except internal cluster communication.
• Gateway Endpoint for S3 handles data storage access.
• Interface Endpoints handle KMS, CloudWatch, and EMR service communication.

2. AWS Glue Connection in VPC Mode

• Glue ETL jobs attach to a specified Subnet and Security Group via Elastic Network Interfaces.
• Requires a Gateway Endpoint for S3 in the subnet route table to prevent Glue jobs from timing out when fetching dependencies or reading S3 Parquet files.

Summary Checklist for DEA-C01 Exam

• Gateway Endpoints: S3 and DynamoDB ONLY. Free. Uses VPC Route Tables.
• Interface Endpoints (PrivateLink): Uses ENIs + Private IPs + Security Groups. Hourly fee.
• Data Exfiltration Prevention: Attach an Endpoint Policy to Gateway Endpoints restricting S3 access strictly to allowed corporate bucket ARNs.
• On-Premises Access: Requires Interface Endpoints (PrivateLink) because Gateway Endpoints cannot be targeted from Direct Connect.