PrivateLink 2

Question 1

Gateway Endpoints

What is a Gateway Endpoint?

Answer 1

Provide private access to S3 or Dynamo DB

Question 2

Gateway Endpoints

What happens when you create a GW Endpoint?

Answer 2

Prefix list added to route table

Question 3

Gateway Endpoints

Which services support both Interface Endpoints and Gateway Endpoints?

Answer 3

Only S3 (not Dynamo)

Question 4

Gateway Endpoints

Can you use Security Groups or NACLs to control access to a Gateway Endpoint?

Answer 4

Nope, it’s not an ENI and doesn’t live IN a Subnet (it’s just routing rules).

Question 5

Gateway Endpoints

What does this addition to the route table look like?

Answer 5

Prefix list is CIDRs as a destination, target is the GW Endpoint

Question 6

Gateway Endpoints

Are GW endpoints regional, zonal, or global?

Answer 6

Regional within a VPC (only one per VPC)

Question 7

Gateway Endpoints

If GW endpoints aren’t per-Subnet, how does routing work (which is per-subnet)?

Answer 7

Associate a GW Endpoint to Subnets. Each Subnet’s route table gets routes.

Question 8

Gateway Endpoints

Is a GW Endpoint HA?

Answer 8

Yes, HA across all AZs in a region by default

Question 9

Gateway Endpoints

What other VPC things is a GW Endpoint similar to?

Answer 9

IGW, VPG. It’s a thing on the VPC border that you can route things to

Question 10

Gateway Endpoints

How do you control access to a GW Endpoint?

Answer 10

Endpoint Policy

Question 11

Gateway Endpoints

Example of something you can control access to with a GW Endpoint?

Answer 11

Restrict an S3 Endpoint to only connect to certain S3 buckets.

Question 12

Gateway Endpoints

Can a GW Endpoint connect to a resource in a different region?

Answer 12

No

Question 13

Gateway Endpoints

Security Design Pattern for S3 Gateway Endpoints?

Answer 13

Prevent Leaky Buckets: bucket policy only allow from Gateway Endpoint

Question 14

Endpoint Policies

What is the TL;DR for Endpoint Policies?

Answer 14

Policy (action/effect/resource/principal) for what the Endpoint can access

Question 15

Endpoint Policies

What can an Endpoint Policy grant access to?

Answer 15

Nothing! It’s like an SCP: it sets the bounds for what can be accessed through it.

Question 16

Endpoint Policies

Can/How do you limit an S3 bucket so it can only be reached by one VPC and not another?

Answer 16

Each VPC has an Endpoint. Bucket policy has DENY if not from the Endpoint ID.

Question 17

Endpoint Policies

Couldn’t you juse use a Condition with “aws:SourceIP” and pick VPC CIDR?

Answer 17

Nope, aws:SourceIP only works on publicly routable, external IP address space