7.5 Private Access: VPC Endpoints, PrivateLink, Client VPN & Verified Access

7.5 Private Access: VPC Endpoints, PrivateLink, Client VPN & Verified Access

Skill 5.1.2 covers mechanisms for secure and private access to resources: AWS PrivateLink, VPC endpoints, AWS Client VPN, and AWS Verified Access. The exam typically describes a workload or user that must reach a service without crossing the public internet, or a data set that must be reachable only from approved networks, and asks which combination of endpoint, policy, and condition key achieves it.

---

VPC Endpoints

S3 supports both types: a gateway endpoint is the low-cost default for traffic from the VPC, and an S3 interface endpoint serves on-premises clients that reach AWS over Direct Connect or VPN.

Endpoint Policies

Gateway endpoints and most interface endpoints accept an endpoint policy, a resource-based policy that limits what can be done through that endpoint. The default policy allows full access. Endpoint policies never grant permissions; the caller's IAM policy and any resource policy must also allow the request. A typical policy lets traffic through the endpoint reach only resources owned by your organization, by principals in your organization:

{
  "Statement": [
    {
      "Sid": "OrgPrincipalsToOrgResourcesOnly",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalOrgID": "o-exampleorgid",
          "aws:ResourceOrgID": "o-exampleorgid"
        }
      }
    }
  ]
}

This blocks a compromised instance from copying data to an attacker-owned bucket through the endpoint.

Restricting Resources to the Endpoint

On the resource side, a bucket policy can deny requests that don't arrive through an approved endpoint or VPC by using aws:SourceVpce or aws:SourceVpc. Requests through a VPC endpoint carry private addresses, so aws:SourceIp (which evaluates public IP addresses) doesn't match them; use aws:VpcSourceIp for the private address. Add exceptions for AWS services acting on your behalf (aws:ViaAWSService or aws:PrincipalIsAWSService), or the deny can break integrations.

---

Data Perimeters

AWS describes a data perimeter as three sets of guardrails that together ensure only trusted identities access trusted resources from expected networks:

RCPs apply identity and network conditions to resources across the organization, and SCPs apply resource and network conditions to your principals.

---

Publishing Your Own Services with PrivateLink

A service provider puts an endpoint service in front of a Network Load Balancer (or Gateway Load Balancer). Consumers in other VPCs or accounts create interface endpoints to it.

• The provider controls allowed principals and can require manual acceptance of each connection request.
• Connections are initiated only from consumer to provider; the provider can't reach into the consumer VPC.
• Overlapping CIDR ranges don't matter, because no routing between the VPCs is created.
• A private DNS name for the service requires domain ownership verification with a TXT record.

This is the standard way to expose a service to many customer or business-unit VPCs without VPC peering or transit gateway routes.

---

AWS Client VPN

AWS Client VPN is a managed OpenVPN-based service for remote users.

• Authentication: mutual certificate authentication (server and client certificates in ACM), Active Directory through AWS Directory Service, or SAML 2.0 federation (for example, with IAM Identity Center). Directory or SAML authentication can be combined with certificates.
• Authorization rules grant access to destination CIDR ranges, optionally only for specific Active Directory or SAML groups.
• Security groups on the target network associations control what VPN clients can reach.
• Split tunnel sends only routes for the VPC through the VPN; full tunnel sends all client traffic through AWS.
• A client connect handler (a Lambda function) can run custom checks, such as device posture or time-of-day rules, before a connection is allowed.
• Connection logging to CloudWatch Logs records connection attempts and results.

---

AWS Verified Access

Where Client VPN gives network-level access to CIDR ranges, Verified Access evaluates every request to a specific application against Cedar policies that use identity and device trust data (Section 7.3). It supports HTTP(S) applications and non-HTTP TCP endpoints such as SSH, RDP, and database connections, so it can replace VPN access for many administrative and internal use cases without giving users a route into the VPC.

---

Specialty Exam Pitfalls

1. Expecting gateway endpoints to work from on-premises: Gateway endpoints are route-table constructs inside the VPC. Use S3 interface endpoints for on-premises access.
2. Using aws:SourceIp for endpoint traffic: Requests through VPC endpoints don't carry public source IPs; use aws:SourceVpce, aws:SourceVpc, or aws:VpcSourceIp.
3. Thinking endpoint policies grant access: They only restrict; IAM and resource policies must still allow the request.
4. Deny-all bucket policies without service exceptions: A strict aws:SourceVpce deny can block AWS services, such as replication or CloudTrail delivery, that call on your behalf.