Keep Your Network Traffic in AWS with VPC Endpoints | Overview and Tutorial

AWS VPC Endpoints are a must-know feature for any setup involving private subnets. This feature helps you avoid routing network traffic through when public internet when trying to communicate with AWS services. Instead, infrastructure components in private subnets can make service calls and keep their traffic in AWS. Learn more about the feature including a step by step walkthrough in this video.
Sign up for my Newsletter to receive regular AWS updates AND get a FREE PDF for 5 AWS Project Ideas: beabetterdev.c...
📚 My Courses 📚
AWS Learning Accelerator - Learn AWS Through a Hands On Project - courses.beabet...
AWS Lambda - A Practical Guide - www.udemy.com/...
🎉SUPPORT BE A BETTER DEV🎉
Become a Patron: / beabetterdev
📚 MY RECOMMENDED READING LIST FOR SOFTWARE DEVELOPERS📚
Clean Code - amzn.to/37T7xdP
Clean Architecture - amzn.to/3sCEGCe
Head First Design Patterns - amzn.to/37WXAMy
Domain Driven Design - amzn.to/3aWSW2W
Code Complete - amzn.to/3ksQDrB
The Pragmatic Programmer - amzn.to/3uH4kaQ
Algorithms - amzn.to/3syvyP5
Working Effectively with Legacy Code - amzn.to/3kvMza7
Refactoring - amzn.to/3r6FQ8U
🎙 MY RECORDING EQUIPMENT 🎙
Shure SM58 Microphone - amzn.to/3r5Hrf9
Behringer UM2 Audio Interface - amzn.to/2MuEllM
XLR Cable - amzn.to/3uGyZFx
Acoustic Sound Absorbing Foam Panels - amzn.to/3ktIrY6
Desk Microphone Mount - amzn.to/3qXMVIO
Logitech C920s Webcam - amzn.to/303zGu9
Fujilm XS10 Camera - amzn.to/3uGa30E
Fujifilm XF 35mm F2 Lens - amzn.to/3rentPe
Neewer 2 Piece Studio Lights - amzn.to/3uyoa8p
💻 MY DESKTOP EQUIPMENT 💻
Dell 34 inch Ultrawide Monitor - amzn.to/2NJwph6
Autonomous ErgoChair 2 - bit.ly/2YzomEm
Autonomous SmartDesk 2 Standing Desk - bit.ly/2YzomEm
MX Master 3 Productivity Mouse - amzn.to/3aYwKVZ
Das Keyboard Prime 13 MX Brown Mechanical- amzn.to/3uH6VBF
Veikk A15 Drawing Tablet - amzn.to/3uBRWsN
🌎 Find me here:
Twitter - / beabetterdevv
Instagram - / beabetterdevv
Patreon - Donations help fund additional content - / beabetterdev
#aws
#vpc
#beabetterdev

[@dashmasterful]

Finally! Someone that could explain this concept clearly and concisely. Thanks!

[@pablogonzalezrobles4429]

Great video. Small detail to mention. About the diagram, vpce is set at subnet level, not vpc level as Internet gateway. It was confirmed on the demo.

[@BeABetterDev]

Thanks for pointing this out!

[@shubhammahajan9117]

Didn’t get you. Could you please elaborate?

[@alexrusin]

​@shubhammahajan9117 There are two types of VPC endpoints: interface and gateway. The interface vpc endpoint has ENI, and you have to associate a security group with it. It is like an EC2 - you have to place it inside a subnet. The gateway vpc endpoint works similar to Internet Gateway - you have to route traffic to it in a route table.
The diagram shows the gateway vpc endpoint. However, in the demo the interface vpc endpoint was shown. That's why Pablo is saying that the endpoint in the diagram should be set at the private subnet level rather than the VPC level.

[@saptarshiganguly1683]

Great tutorial as always. Looking forward to learning more concepts related to VPC like PrivateLink, Transit gateway, etc from you.

[@alexrusin]

Great tutorial as usual! Thank you. I wonder if you can do a video about VPC endpoint type gateway. I think it would be useful for people who use S3 buckets and DynamoDB.

[@JohnS-er7jh]

Thanks for posting the video. I didn't realize the AWS VPC EndPoint also has a Security Group, I thought Security Groups were only attached to EC2 Instances.

[@BeABetterDev]

You're very welcome! Yes Security Groups can be attached to many different types of infrastructure (including even load balancers!). Whenever you have a connection problem its always a good idea to check the security group configuration first.

[@likithabh3944]

Good one, you made it very clear and easy to understand!

[@thecyrusj13]

Pretty good. It would be a little better if the function tested at the end were a little more solid. For example maybe have an app hosted by S3 that that uses the endpoint or something like that to prove that it works. But I'm going to do this anyway.

[@bsrameshonline]

Super explanation on how AWS endpoint is used

[@Reflekt0r]

Thank you, thank you, thank you! Finally I understood the concept! 🙏🙏🙏

[@mathewkargarzadeh3158]

Amazing Tutorial on VPC Endpoints. you are the best !!!

[@RajKeerthi-p2f]

I got a question here. You did not shown how did the VPC endpoint had accessed the s3? this was the question the video was trying to solve right? sorry If I have asked the wrong question. Thank you.

[@AfikAfikAfik]

Hi there, thank you for another great video!
Could you please extend more about the "Service" who been chosen on 9:57.
I'm not sure what is the meaning of this.
Thanks!

[@shaunypie99]

Excellent demo and explanation. Thanks buddy 🙂

[@BeABetterDev]

Glad you liked it!

[@kuldipsatpute9866]

Great job… But I’ve question… If this instant is isolated then how can we get updates and install software… if we assign NAT gateway the how this endpoint will react…

[@HassnainKhizar]

Great explanation

[@leamon9024]

Awesome video! Is there any chance to talk about AWS graviton which can be used in multi-arch docker container for better performance and more cost effective in AWS ECS/EKS/Lambda? Thanks!

[@DevOps-Cloud]

Awesome, but what if VPC is in another account and bucket in another account?

[@vlajov]

Great stuff as always! Thanks for showing demo!
For the first part I have a question:
In case we need only one EC2 instance to connect securely and with no cost to S3, we can use interface VPC endpoint or Gateway endpoint is the only option?

[@mjamaltv]

THANK YOU THANK YOU THANK YOU THANK YOU THANK YOU THANK YOU!!!!!!!!

[@AliNaghipourfar-o3f]

Thank you so much for this great video

[@OmarAli-gm5lx]

Great video! how do you produce your diagrams?

[@BeABetterDev]

Thank you! All in Powerpoint :)

[@OmarAli-gm5lx]

@@BeABetterDev wow please do a tutorial when you can i would pay for this

[@adrian_franczak]

What about connecting from internet to lambda and lambda save data to database in vpc - should I put lambda also in vpc?

[@scottboggs2364]

I have seen many vids like this about setting up PL to S3, but NO ONE makes it clear how to use the endpoint. How do you make a S3 CLI connection to this endpoint? How are buckets for multiple accounts accessed? etc.

[@DF-ss5ep]

I don't know, I'm still learning it, but my guess is that the DNS will resolve to an IP inside AWS's network. The request for that IP will follow the route to the table and then to the endpoint. It should be easy to check, anyway, since the request is not supposed to work without it on a private subnet.

[@themarksman1]

@@DF-ss5ep DNS ‘ll resolve to an ENI within the VPC instead of Public IP of the S3 bucket. Needless to say any traffic arriving at this ENI will be tunneled within AWS network (without traversing Internet) to the S3 bucket. That is how Private link works. It sets up a tunnel from ENI in your VPC to S3/any AWS service. No RouteTables are used in case of Interface Endpoints.
RouteTables are used only for Gateway Endpoints which is available for select AWS services like S3, DynamoDB. These services use well-known IP address range that can be checked with a Prefix-list. Then a RouteTable entry is made with as the .

[@digitnomad]

@12, I like "diligently refreshing..." :)

[@tvvuday]

Very good video, Nice content, it helps me on learning new scenarios,
Thanks, @Be A Better Dev

[@BeABetterDev]

Glad to help!

[@LinuxForLife]

Nice! Thanks.

[@BeABetterDev]

Welcome!

[@indiraparasa6805]

Helpful vedio ❤

[@ImaneElouadi-eq1zc]

Loved it ,thanks :)

[@tibistibi]

the security groups are connected to each other, how would this be working when you have vpc's in two accounts connected via a peering connection?

[@datajake2742]

I'm probably confused but why not just one security group?

[@jytan740]

can Amazon linux ec2 talk to s3 by default with the s3 role assigned to ec2? (not sure by default is there a s3 vpc endpoint)

[@aliamir2473]

can you make a video on autoscaling please

[@hassanelkhouli]

Amazing !

[@BeABetterDev]

Thank you! Cheers!

[@danielhooverc]

It seems like my instance in a private subnet can still access an S3 bucket even though I haven't set security groups for the endpoint and this instance. How can that be?

[@RABWA333]

Thanks a lot

[@shubhammahajan9117]

What is the exact difference between VPC endpoint and Nat gateway then? When to use what?

[@madrag]

vpc endpoint allow you to communicate to/from aws services (depends on the endpoint type) via their backbone network, nat gateway is well just nat gateway and act as one.

[@alexrusin]

You use NAT gateway if you want your services placed in a private subnet to access the internet. Make API calls, for example.

[@MyRonniej]

what's the purpose of the lambda in this case

[@joshuaspector8182]

I was wondering this too

[@justin_t]

What is the service name for parameter store? is it kms?

[@user-if2kq8nh8m]

Be careful though, VPC endpoints do have a bit of a steep price

[@bibhu_pala]

How to test after setting this?

[@BuildOnAWS]

Great, comprehensive demo! Thank you

[@davidalexander8786]

10:15 "states" because steps functions are state-machines

[@MosesAbel-n5o]

945 Dale Brooks

[@catchroniclesbyanik]

Incomplete tutorial plus you put more emphasis on setting up security group which was very distracting