Welcome to 'Back to Basics'.
I'm Brian Maguire.
Today, I'm gonna show you how you can connect your services
to external provider applications with AWS PrivateLink.
It's common for applications to be dependent on external services,
such as shared Services, external SaaS provider applications,
and other AWS services.
This is similar to how a candy vending machine has a dispatch service
that is dependent on a remote credit card processing service
to handle the transaction via network.
And there's several ways to connect these services;
such as over the internet, through VPNs, peering, and other network means.
Connecting applications securely to their dependent components
is foundational for applications.
And these applications need seamless,
reliable, and performant communication.
You will learn how to use AWS PrivateLink to connect both internally shared
and SaaS services with endpoint services.
Access is secured by directly connecting them through AWS's private network.
Let's dive in.
Here is a typical environment.
We have a consumer application service running in VPC A.
It connects to a dependent source service deployed in another AWS account
in VPC B.
The service provider in VPC B is a shared service with an API accessible
through the internet through a load balancer endpoint.
The consumer service consumes the external application via VPC routing.
It routes a request to the NAT gateway, to the internet gateway (IGW),
and to the external service.
Although consuming a service over the internet is acceptable at start,
as your traffic increases, you may have requirements to improve cost,
reliability, and performance.
This is where AWS PrivateLink comes in.
PrivateLink allows you to connect an application
running in separate Amazon VPCs,
AWS accounts, and on-premise networks through a simple,
private, and secure service endpoint.
Network traffic that uses AWS PrivateLink
doesn't traverse the public internet, reducing exposure to brute force
and distributed denial service attacks, along with other threats.
You can use private IP connectivity so your services function
as though they were hosted directly within your VPC.
You can associate security groups, and attach an endpoint policy,
which allow you to control precisely who has access
to a specified service.
It is more cost optimized when using PrivateLink network versus the internet.
PrivateLink does not require NAT gateways and IGW traffic.
You can also consume services through a third party SaaS provider
or an AWS Marketplace partner.
AWS PrivateLink enable SaaS providers to build highly scalable
and secure services on AWS.
They can privately expose their service to you as an external service.
With PrivateLink, access can only be initiated by you
through a request to the provider service and the provider service
can only respond to your requests.
This offers one-way private connectivity from your VPC to the external provider service.
Now that you've seen how PrivateLink securely connects consumer and provider services,
let's take a deeper dive and see how PrivateLink works.
We set up PrivateLink by first creating an endpoint service in the service provider.
The endpoint service is associated with a Network Load Balancer or NLB
for the provider service.
For high availability and low latency, I recommend using an NLB with targets
in at least two availability zones within the VPC.
Access can be controlled by allowing principles such as IM users and IM roles
or AWS accounts to the allow list for the service.
You can also set the endpoint acceptance settings for acceptances required.
After a mutual acceptance of the endpoint by the consumer and the provider,
an interface endpoint is inserted in the subnets
with the consumer VP CIDR IP address space.
DNS is also created in the consumer VPC
so the endpoint request traversed through PrivateLink.
The communication is strictly unidirectional.
Requests start from consumer's VPC,
and the response only coming from the provider's PrivateLink service.
The communication between the service is private, to sustain bandwidth
of 10 gigabits per second, per availability zone,
with bursts up to 40 gigabits per second.
You may also need to connect your Shared Services
to many consumer services across several VPCs.
And you may have overlapping VPC CIDR IP address ranges.
You may also have an internally shared service that needs to be consumed by several VPCs.
A single endpoint service can be consumed by several service consumers
from different accounts.
When using PrivateLink, it removes CIDR overlap concerns
and simplifies the network management, as additional routes are not required.
AWS PrivateLink is also a great way to consume services on premise
without requiring public IP addresses or going through the internet.
On-premise consumers can access PrivateLink endpoint services
over AWS Direct Connect.
Let's take a look at a scenario with an on-premise application.
Your on-premise resources can also access AWS PrivateLink
endpoint services over AWS Direct Connect
while also keeping the network traffic within the AWS private network.
An on-premise request goes through the Customer Provided Equipment or CPE
to Direct Connect, to the VPC, to the virtual interface,
to the service endpoint provider over PrivateLink.
So there you have it, a simplified private network for your Shared Services
and external providers with AWS PrivateLink.
Check out the links below for more details.
Have fun building your network and see you next time.