PrivateLink
6 posts tagged PrivateLink.
An S3 endpoint policy that names only your buckets breaks dnf and docker pull
Amazon Linux package repositories and ECR image layers are S3 objects in buckets AWS owns. Lock a gateway endpoint policy down to your own buckets and both stop working, with an access-denied that names a bucket you have never heard of. The policy language has three more traps, and the default policy is the only one that cannot hit them.
Networking7 minThe NAT Gateway bills the download too, and three other lines that never say NAT
Inbound data transfer from the internet is free. A gigabyte downloaded through a NAT Gateway still costs $0.045, because the processing charge applies regardless of the traffic's source or destination. That is the line people model. The Elastic IP, the zone boundary, and the data transfer out stack on top of it, and none of them is labelled NAT Gateway on the bill.
Networking7 minus-east-1a is not the same place in your account and theirs
Availability Zone names are mapped per account, deliberately and randomly, in every Region that existed before November 2012. A PrivateLink consumer who builds in us-east-1a can be refused an endpoint for a service that is, by the provider's naming, in us-east-1a. The identifier that is the same everywhere is the AZ ID, and almost nothing is written in it.
Networking6 minA custom DNS server in your DHCP options turns off private DNS for every endpoint in the VPC
Private hosted zones, interface endpoint private DNS, and Route 53 Resolver rules all live in one place: the VPC resolver at .2. Point the DHCP option set at your own DNS servers and every instance stops asking it. Nothing is deleted, nothing is disabled, and every one of those features quietly stops applying.
Networking5 minPrivateLink traffic always arrives from the load balancer, whatever you configure
Client IP preservation has no effect on inbound PrivateLink traffic. If you turn it on and write client-IP security group rules, direct clients work and every PrivateLink consumer breaks — which is a difficult failure to see from the provider side.
Networking7 minAn interface endpoint with private DNS off is a bill with no benefit
It costs the same per hour as one that works, reaches available, passes every reachability check, and nothing routes to it. The Terraform default is false, which is most of why this ships.
Networking5 min