What is difference between AWS PrivateLink and VPC Peering?

Question

Is VPC Peering secure? Do VPC Peering and PrivateLink both don't use the internet gateway or any other gateway?

Answer 1

VPC Peering allows connectivity between two VPCs. It's just like normal routing between network segments.

VPC PrivateLink allows you to publish an "endpoint" that others can connect with from their own VPC. It's similar to a normal VPC Endpoint, but instead of connecting to an AWS service, people can connect to your endpoint. Think of it as a way to publish a private API endpoint without having to go via the Internet.

In both cases, no traffic goes across the Internet. Connectivity is directly between the VPCs.

Answer 2

VPC Peering vs PrivateLink

These 2 developed separately, but have more recently found themselves intertwined.

• VPC Peering - applies to VPC

• PrivateLink - applies to Application/Service

With VPC Peering you connect your VPC to another VPC. Both VPC owners are involved in setting up this connection. When one VPC, (the visiting) wants to access a resource on the other (the visited), the connection need not go through the internet.

PrivateLink provides a convenient way to connect to applications/services by name with added security. You configure your application/service in your VPC as an AWS PrivateLink-powered service (referred to as an endpoint service). AWS generates a specific DNS hostname for the service. Other AWS principals can create a connection to your endpoint service after you grant them permission.

VPC Peering + PrivateLink

As of March 7, 2019, applications in a VPC can now securely access AWS PrivateLink endpoints across VPC peering connections. AWS PrivateLink endpoints can now be accessed across both intra- and inter-region VPC peering connections. More on this

Notes on VPC Peering

VPC peering allows VPC resources including ... to communicate with each other using private IP addresses, without requiring gateways, VPN connections, or separate network appliances. ...Traffic always stays on the global AWS backbone, and never traverses the public internet

Inter-Region VPC Peering provides a simple and cost-effective way to share resources between regions or replicate data for geographic redundancy.

AWS - What is VPC Peering

Notes on Endpoint Services

When you create a VPC endpoint service, AWS generates endpoint-specific DNS hostnames that you can use to communicate with the service. These names include the VPC endpoint ID, the Availability Zone name and Region Name, for example, vpce-1234-abcdev-us-east-1.vpce-svc-123345.us-east-1.vpce.amazonaws.com. By default, your consumers access the service with that DNS name

When you create an endpoint, you can attach an endpoint policy to it that controls access to the related service

An endpoint policy does not override or replace IAM user policies or service-specific policies (such as S3 bucket policies). It is a separate policy for controlling access from the endpoint to the specified service.

• AWS Endpoint access
• AWS VPC Endpoint access

Answer 3

Let's understand this by a real-life use case

1. Suppose You have your Own VPC (created by you using your own AWS Account) in which you have few EC2 instances that wants to communicate with instances running in your Client's VPC - obviously this VPC is created by your client using his/her AWS Account - Use VPC Peering to achieve this communication requirement

2. Now consider you have your OWN VPC (created by you using your own AWS Account) with EC2 Instance running inside it, and using the same AWS account you uploaded some files in S3. And your EC2 Instance now wants to read content of the file in S3.

In this case you will configure VPC Endpoint - which uses PrivateLink technology - AWS PrivateLink allows you to privately access services hosted on the AWS network in a highly available and scalable manner, without using public IPs and without requiring the traffic to traverse the internet.

Hope this helps!