AWS PrivateLink

Access services hosted on AWS easily and securely by keeping your network traffic within the AWS network

AWS PrivateLink simplifies the security of data shared with cloud-based applications by eliminating the exposure of data to the public Internet. AWS PrivateLink provides private connectivity between VPCs, AWS services, and on-premises applications, securely on the AWS service network. AWS PrivateLink makes it easy to connect services across different accounts and VPCs to significantly simplify the network architecture.


Secure Your Traffic

Connect your VPCs to services in AWS in a secure and scalable manner with AWS PrivateLink. AWS PrivateLink traffic doesn't traverse the Internet, reducing the exposure to threat vectors such as brute force and distributed denial-of-service attacks. Use private IP connectivity and security groups so that your services function as though they were hosted directly on your private network.

Simplify Network Management

Significantly simplify your internal network architecture with AWS PrivateLink. Connect services across different accounts, and VPCs within your own organization, with no need for firewall rules, path definitions, or route tables. There is no longer a need to configure an Internet gateway or a VPC peering connection.

Accelerate Your Cloud Migration

More easily migrate traditional on-premises applications to SaaS offerings hosted in the cloud with AWS PrivateLink. Since your data does not get exposed to the Internet where it can be compromised, you can migrate and use more cloud services with the confidence that your traffic remains secure and compliant with regulations. You no longer have to choose between using a service and exposing your critical data to the Internet.

Use cases

Securely Access SaaS Applications

SaaS providers are collecting data from their enterprise customers and using the data for log analysis, security scans, or performance management. SaaS providers will install agents or clients in their customers' VPCs to generate and send data back to the provider. When using SaaS applications, customers have to choose between allowing Internet access from their VPC, which puts the VPC resources at risk, and not using these applications at all. With AWS PrivateLink, you can connect your VPCs to AWS services and SaaS applications in a secure and scalable manner.

Maintain Regulatory Compliance

Preventing personally identifiable information (PII) from traversing the Internet helps maintain compliance with applicable regulations. With AWS PrivateLink you can confidentially share PII by connecting your AWS resources with AWS services or VPCs from third-party organizations. PII traffic between VPCs and AWS services doesn’t traverse the Internet where it could become compromised. You can share your data offline over AWS PrivateLink and continue to enforce your regulatory compliance.

Migrate To Hybrid Cloud

Easily migrate services from on-premises locations to the AWS cloud. On-premises applications can connect to service endpoints in Amazon VPC over AWS Direct Connect. Service endpoints will direct the traffic to AWS services over AWS PrivateLink, while keeping the network traffic within the AWS network. AWS PrivateLink enables SaaS providers to offer services that will look and feel like they are hosted directly on a private network. These services are securely accessible both from the cloud and from premises via AWS Direct Connect, in a highly available and scalable manner.

How it works


AWS PrivateLink enables you to securely connect your VPCs to supported AWS services: to your own services on AWS, to services hosted by other AWS accounts, and to third-party services. Since traffic between your VPC and any one of these services does not leave the AWS service network, an Internet gateway, NAT device, public IP address, or VPN connection is no longer needed to communicate with the service.

To use AWS PrivateLink, create an interface VPC endpoint for a service in your VPC. This creates an Elastic Network Interface (ENI) in your subnet with a private IP address that serves as an entry point for traffic destined to the service. Service endpoints available over AWS PrivateLink will appear as ENIs with private IPs in your VPCs.

To learn more about how PrivateLink works, read the PrivateLink documentation.

Learn more about AWS PrivateLink

Visit the features page
Ready to build?
Request an account
Have more questions?
Contact us