Lecture 61: VPC PrivateLink - Important to know features
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：08:34
- 来源：Udemy Lecture 50324611
- Slide 数量：9
- 画面切换：00:28、02:19、03:30、05:51、06:34、07:00、07:16、08:01
扫描说明
逐条检查了 Udemy 页面中的 130 条 Transcript cue，并对全长 08:34 的视频画面进行扫描。依据功能总览、重叠 CIDR、多可用区、Security Group、IP/网络协议与远程网络访问等主题切换，共划分出 9 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. PrivateLink 重要特性导论
时间范围：00:00–00:28
总结 / Summary
中文
本节说明后续将交替使用 VPC 端点（VPC Endpoint）与私有链路（PrivateLink）两个说法，但均特指由 PrivateLink 支持的端点，不包括网关端点（Gateway Endpoint）。
English
This introduction explains that VPC endpoint and PrivateLink will be used interchangeably for PrivateLink-powered endpoints, excluding Gateway Endpoints.
Transcript
00:00 Okay, now let's understand some important things about the VPC endpoint and private link.
00:06 And please again don't get confused between VPC gateway endpoints.
00:09 Now whenever we talk about VPC endpoint we are going to talk in the context of VPC private link.
00:15 So we will use these terms interchangeably.
00:19 So please make sure that you don't get confused.
00:21 Okay so let's get to this now important thing that you should know that when you create a VPC endpoints
2. Interface Endpoint 的重要功能总览
时间范围：00:28–02:19
总结 / Summary
中文
接口端点（Interface Endpoint）会在使用者 VPC 内创建带私有 IP 地址的弹性网络接口（Elastic Network Interface, ENI）。它支持重叠 CIDR（overlapping CIDRs）、跨多个可用区（Availability Zones, AZs）的高可用性、安全组（Security Group）入站控制、IPv4/IPv6、TCP/UDP，并可从其他互联网络访问。
English
An Interface Endpoint creates an Elastic Network Interface (ENI) with a private IP address in the consumer VPC. It supports overlapping CIDRs, multi-AZ high availability, inbound Security Group controls, IPv4/IPv6, TCP/UDP, and access from other connected networks.
Transcript
00:28 powered by Privatelink, it creates Eni into your subnet inside your VPC, right?
00:35 And that Eni has the private IP from your subnet.
00:39 So it has a local IP address through which you access the target AWS services or the network.
00:45 And we already talked about that.
00:48 Another important thing to note is that because you have the local IP address, now you can connect
00:56 to the services inside a VPC which has overlapping cidrs.
01:00 So your consumer VPC might have the same Cidr as your Target VPC.
01:05 And shortly we'll talk about this further.
01:08 For high availability, you have to create this VPC endpoint across multiple availability zones in the
01:13 consumer VPC.
01:14 And again I will show you what do I mean by that.
01:18 And VPC endpoint having Eni.
01:20 It also has the security groups.
01:23 And for us it is the inbound rule which comes into effect.
01:28 And I will show you how the security group rule should be.
01:32 Further it supports both IPv4 and IPv6 traffic.
01:35 We briefly talked about that.
01:37 And it also supports TCP and UDP traffic.
01:41 And finally VPC endpoint being Eni can be accessed over from other networks.
01:46 That means if you have a consumer VPC in which you have VPC endpoint, and that consumer VPC has VPC
01:53 connected over VPC peering connection or the transit gateway, for example, then that endpoint is accessible
01:59 because there is an IP address for that endpoint.
02:03 And again we will see some scenarios around this.
02:06 So these are all the important points that you should know about VPC endpoint with private link.
02:14 And now let's go over all this one by one so that you really get it right.
3. 使用 PrivateLink 连接重叠 CIDR 的 VPC
时间范围：02:19–03:30
总结 / Summary
中文
即使提供方 VPC 与使用者 VPC 使用相同或重叠的 CIDR（overlapping CIDRs），PrivateLink 仍能工作。使用者只连接自己 VPC 中 Endpoint ENI 的本地私有 IP，提供方地址被隐藏，因此不受 VPC 对等连接（VPC Peering）和中转网关（Transit Gateway）要求 CIDR 不重叠的限制。
English
PrivateLink works even when the provider and consumer VPCs use identical or overlapping CIDRs. The consumer connects to the local private IP of the endpoint ENI, while provider-side addressing remains hidden, avoiding the non-overlapping-CIDR requirement of VPC Peering and Transit Gateway routing.
Transcript
02:19 So first thing now imagine that there is a provider VPC and consumer VPC.
02:24 So without endpoints what you will typically do you will connect this to VPCs or say VPC peering connection
02:30 or transit gateway.
02:31 But in both the cases you should have non-overlapping ideas for those two VPCs.
02:37 Otherwise you can't connect using the VPC peering connection or transit gateway.
02:41 But VPC endpoint solves this problem.
02:44 And this is possible because this endpoint is having the local IP from this VPC.
02:50 So here let's take an example that in the provider VPC you have your EC2 instances having the services
02:56 running.
02:57 And these instances have similar IP address as the consumer VPC say 10.0.0.15 here.
03:05 And now you create this VPC endpoint.
03:08 And that's an interface endpoint.
03:09 And it also gets one IP address.
03:12 is now.
03:13 This client can access this service using this local IP address.
03:16 So it doesn't matter what IP addresses are there in the service provider VPC.
03:21 So this is one of the biggest advantage of using the VPC endpoints with private link.
03:28 Right.
03:28 So I hope it is clear.
4. 跨可用区部署与高可用性
时间范围：03:30–05:51
总结 / Summary
中文
为获得高可用性（high availability），应在多个子网（subnets）和可用区（Availability Zones, AZs）中创建 Interface Endpoint ENI，并让客户端优先使用同一 AZ 的端点。只部署单个 AZ 虽可跨子网访问，但会形成单点故障，并产生跨可用区数据传输费（cross-AZ data transfer charge）。
English
For high availability, create Interface Endpoint ENIs in subnets across multiple Availability Zones and have clients use the endpoint in their local AZ. A single-AZ endpoint can still be reached across subnets, but it becomes a single point of failure and incurs cross-AZ data transfer charges.
Transcript
03:30 Next let's talk about the availability zones.
03:33 Now this is an architecture where we are showing two types of the endpoints that you access.
03:39 One is AWS service endpoint and another is your own service hosted in another target VPC.
03:45 Right.
03:45 So for this you will create say VPC interface endpoints into your consumer VPC.
03:51 And you can access these services on the right side.
03:55 Now here we are not showing the availability zones, but in reality every VPC interface endpoint should
04:02 be created in multiple availability zones.
04:05 So now if assume we have two subnets across two different availability zones inside this VPC and there
04:11 are two clients, and both these clients needs to access both this S3 as well as the So this VPC endpoint
04:18 service hosted in another VPC.
04:20 So ideally you should create VPC endpoint in these two subnets.
04:25 And when you create the interface endpoint it will ask you in which all subnets you want this to be
04:30 hosted.
04:31 So as you can see here now there are two endpoint Enis created across two subnets right now.
04:38 In that case this client will access say S3 service using this particular Eni.
04:44 And client two will access it through the local subnet Eni basically.
04:50 And it will work similarly for this particular VPC endpoint service you will create another endpoint.
04:57 And there also you will create that across two availability zones right.
05:02 And then traffic will go like this.
05:04 So this is what is recommended.
05:06 But it's not necessary.
05:08 Which means that you can also create the VPC endpoint only in one of the subnet.
05:13 And in that case the client two can access the Eni into another subnet.
05:20 Right.
05:20 But the problem is, if you do that, there will be cross zone data transfer charges as well as it won't
05:26 be highly available.
05:28 If there is some outage in the AZ, then you cannot access the target services because that is not functional.
05:36 So for both the reasons high availability as well as to not to have the inter AZ data transfer charge,
05:43 you should have multiple Enis across availability zones.
05:48 Right.
05:48 So I hope it is clear.
5. Endpoint ENI 的 Security Group
时间范围：05:51–06:34
总结 / Summary
中文
Endpoint ENI 关联的安全组（Security Group）主要依靠入站规则（inbound rule）控制访问。规则应允许客户端源地址访问端点实际监听的端口；例如 HTTPS 服务通常允许 VPC CIDR 或指定私有 IP 访问 TCP 443。
English
The Security Group attached to the endpoint ENI primarily controls access through inbound rules. Those rules must allow client source addresses to reach the endpoint's listening port—for example, permitting the VPC CIDR or selected private IPs to use TCP 443 for HTTPS.
Transcript
05:51 Now moving on.
05:52 What about the security group.
05:53 As I said because it's Eni it comes with the security group.
05:57 And if you see this security group inbound rules are applied here because this client is sending requests
06:04 to the Eni.
06:06 And that's where there should be an inbound rule.
06:08 Say for example, if you are accessing S3 over 403, then 443 traffic should be allowed from the client
06:15 private IP address.
06:16 So here we are putting the VPC, Cidr so that all the clients can access the VPC endpoint Eni.
06:23 Right.
06:24 And that's about it basically.
06:26 So remember that interface endpoint any should have the inbound rules from the client okay.
6. IPv4、IPv6 与双栈支持
时间范围：06:34–07:00
总结 / Summary
中文
Interface Endpoint 支持 IPv4、IPv6 和双栈（dual-stack）。客户端与由网络负载均衡器（Network Load Balancer, NLB）支持的端点服务（Endpoint Service）可按场景使用 IPv4、IPv6 或双栈地址。
English
Interface Endpoints support IPv4, IPv6, and dual-stack operation. Clients and Network Load Balancer (NLB)-backed endpoint services can use IPv4, IPv6, or both as required by the design.
Transcript
06:34 Next what about the IP protocol.
06:36 So now it supports both IPv4 and IPv6 protocol.
06:40 And as we already discussed client can have IPv4 or IPv6 or both addresses.
06:46 And the service which is hosted behind network load balancer can also have both IPv4 or IPv6 address
06:53 or both.
06:53 That's in a dual stack mode.
06:55 And then it supports both IPv4 and IPv6 traffic.
7. TCP 与 UDP 网络协议
时间范围：07:00–07:16
总结 / Summary
中文
PrivateLink Endpoint 支持传输控制协议（Transmission Control Protocol, TCP）和用户数据报协议（User Datagram Protocol, UDP），可承载基于这两类传输层协议的私有服务流量。
English
PrivateLink endpoints support both Transmission Control Protocol (TCP) and User Datagram Protocol (UDP), enabling private service traffic over either transport protocol.
Transcript
07:00 Further, with respect to the network protocol, it supports both TCP and UDP traffic.
07:07 So that's about the network protocol.
07:09 And the last important thing about the VPC interface endpoint is that it can be accessed from other
8. 从远程网络访问 Interface Endpoint
时间范围：07:16–08:01
总结 / Summary
中文
由于 Interface Endpoint 是 VPC 内具有私有 IP 的 ENI，只要路由和安全策略允许，就能从对等 VPC（peered VPC）、中转网关（Transit Gateway）互联网络，以及通过虚拟专用网络（VPN）或专线（AWS Direct Connect）连接的本地网络访问。网关端点（Gateway Endpoint）不具备这种远程访问模型。
English
Because an Interface Endpoint is an ENI with private IP addresses inside the VPC, it can be reached—subject to routing and security—from peered VPCs, Transit Gateway-connected networks, and on-premises networks over VPN or AWS Direct Connect. Gateway Endpoints do not provide this remote-access model.
Transcript
07:16 networks.
07:17 So what do I mean.
07:18 So here is the consumer VPC right.
07:20 And there are Enis created.
07:22 And these are the VPC endpoint services or AWS services which you are accessing privately.
07:28 But because this is Eni and it has IP address from the VPC, it can be accessed from say peered VPC
07:36 or from the transit gateway, or even from the on premises network which is connected over VPN or Direct
07:42 Connect.
07:43 Right.
07:44 So that's a fundamental difference between VPC gateway endpoint where you can't access it from other
07:50 networks, but VPC interface endpoints or in general VPC endpoints powered by private link can be accessed
07:57 from the remote network.
07:59 Right?
08:00 So I hope it is clear.
9. 关键特性回顾与 DNS 预告
时间范围：08:01–08:34
总结 / Summary
中文
本讲回顾了 Endpoint ENI、重叠 CIDR（overlapping CIDRs）、多可用区（multi-AZ）、安全组（Security Group）、IPv4/IPv6、TCP/UDP 和远程网络访问等核心能力。下一讲将讨论端点域名系统（Domain Name System, DNS），这是实际部署 PrivateLink 时的关键环节。
English
The lecture closes by reviewing endpoint ENIs, overlapping CIDRs, multi-AZ deployment, Security Groups, IPv4/IPv6, TCP/UDP, and remote-network access. The next lecture covers endpoint Domain Name System (DNS), a critical part of real-world PrivateLink deployments.
Transcript
08:01 And with that again just putting this forward, these are all the important things that you should know
08:08 about the VPC endpoint and private link.
08:12 Okay.
08:12 So we'll stop here for this lecture.
08:14 And now let's get into a little more advanced concept.
08:16 That is how do you handle the DNS for VPC endpoint.
08:20 And it is really really important to understand so that it is very clear how to configure the VPC endpoints
08:27 in real life.
08:29 Okay.
08:29 With that we'll stop here.
08:31 And let's go to the next lecture.
08:32 Thank you.
整讲总结 / Overall Summary
中文
本讲系统梳理了 VPC PrivateLink Interface Endpoint 的设计要点：它以使用者 VPC 内的 ENI 为私有入口，能够连接重叠 CIDR（overlapping CIDRs）的网络，通过多可用区（multi-AZ）部署提高可用性，并以安全组（Security Group）限制访问。Endpoint 同时支持 IPv4/IPv6、TCP/UDP，以及通过 VPC Peering、Transit Gateway、VPN 和 AWS Direct Connect 的远程访问。
English
This lecture summarizes the key design characteristics of VPC PrivateLink Interface Endpoints: a consumer-side ENI provides the private entry point, overlapping CIDRs are supported, multi-AZ deployment improves availability, and Security Groups restrict access. Endpoints support IPv4/IPv6, TCP/UDP, and remote access through VPC Peering, Transit Gateway, VPN, and AWS Direct Connect.
返回顶部 ↑