Lecture 63: Hands On: VPC interface endpoint to access Amazon SQS queue
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：14:59
- 来源：Udemy Lecture 50324619
- Slide 数量：17
- 画面切换：00:13、00:38、00:50、02:52、03:12、04:10、06:01、06:30、07:10、08:23、10:02、11:15、12:17、13:22、13:51、14:32
扫描说明
逐条检查了 Udemy 页面中的 242 条 Transcript cue，并对全长 14:59 的视频画面进行扫描。依据概念幻灯片、实验架构与清单，以及控制台中的网络、权限、SQS、EC2、Endpoint、DNS 验证和清理阶段，共划分出 17 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 通过 VPC Endpoint 私有访问 AWS 服务
时间范围：00:00–00:13
总结 / Summary
中文
本讲将通过接口端点（Interface Endpoint）和私有链路（PrivateLink），让私有子网（private subnet）中的 Amazon EC2 在没有互联网连接的情况下访问 Amazon SQS。
English
This hands-on lecture uses an Interface Endpoint and AWS PrivateLink so an Amazon EC2 instance in a private subnet can access Amazon SQS without Internet connectivity.
Transcript
00:00 Okay, now let's do an hands on exercise where we will access one of the AWS services using the VPC
00:07 endpoint.
00:08 Right.
00:08 So the scenario will be something very similar that we are talking about.
2. Interface Endpoint 访问模型回顾
时间范围：00:13–00:38
总结 / Summary
中文
客户端通过 VPC 内的端点弹性网络接口（Elastic Network Interface, ENI）私有 IP 进入 PrivateLink，再访问 AWS 服务。该模型把服务访问保留在 AWS 私有网络中。
English
The client reaches the endpoint Elastic Network Interface (ENI) through its private IP inside the VPC, and PrivateLink carries the traffic to the AWS service. The access path remains on the AWS private network.
Transcript
00:13 So we will have the VPC with private subnet.
00:16 And we will have a client EC2 instance.
00:18 And from there we want to access one of the AWS services privately using the VPC endpoint and private
00:25 link.
00:26 And in order to do this exercise, one thing that you need to understand is how the DNS work for VPC
00:33 endpoint.
00:33 So I'm just flashing this slide here which we already covered.
3. Endpoint DNS 与 Private DNS 回顾
时间范围：00:38–00:50
总结 / Summary
中文
AWS 服务具有公共 DNS 名称，而 Interface Endpoint 具有区域 DNS（Regional DNS）和可用区 DNS（Zonal DNS）。启用私有 DNS（Private DNS）后，服务原有主机名可在 VPC 内解析到 Endpoint ENI 的私有 IP；否则客户端必须显式使用端点专用 DNS（endpoint-specific DNS）。
English
AWS services have public DNS names, while Interface Endpoints provide Regional and Zonal DNS names. With Private DNS enabled, the normal service hostname resolves inside the VPC to the endpoint ENI's private IP; otherwise the client must explicitly use endpoint-specific DNS.
Transcript
00:38 So we are going to really use what we have already learned about right.
00:44 Okay.
00:45 So now with respect to the architecture we will have private EC2 instance in one of the subnet.
4. SQS Endpoint 实验架构与安全路径
时间范围：00:50–02:52
总结 / Summary
中文
实验沿用先前的 VPC，并在同一可用区（Availability Zone, AZ）中使用 EC2 Instance Connect Endpoint、私有 EC2 子网和专用 VPC Endpoint 子网，以避免跨可用区传输费（cross-AZ data transfer charge）。EC2 通过 IAM 角色（IAM role）获得 SQS 权限；EC2 安全组（Security Group）允许出站 HTTPS，Endpoint ENI 安全组允许来自 EC2 的入站 TCP 443。
English
The lab reuses the earlier VPC with an EC2 Instance Connect Endpoint, a private EC2 subnet, and a dedicated VPC endpoint subnet in the same Availability Zone to avoid cross-AZ transfer charges. An IAM role grants SQS permissions to EC2; the EC2 Security Group permits outbound HTTPS, and the endpoint ENI Security Group permits inbound TCP 443 from EC2.
Transcript
00:50 And if you remember at least this two subnet we had created in the earlier exercise that we did for
00:56 VPC gateway endpoint to access S3.
00:58 So we can continue to use the same VPC.
01:01 And in that we had this EC2 instance connect so that we can privately connect to this EC2 instance.
01:07 And this time we are accessing SQS service.
01:09 So there should be IAM role which allows the permissions to put message or get message from SQS queue.
01:17 And further we would also have to create one of the SQS queue.
01:20 Okay.
01:21 Now in order to create this endpoint we need another subnet.
01:25 Now you can very well create the endpoint in one of the subnet here which is already there.
01:30 But it's a best practice to have a dedicated subnet for your VPC endpoints right.
01:36 So we will create an interface endpoint which will create one of the Eni in this subnet.
01:41 And then we can use that Eni to access the SQS service.
01:44 Right.
01:45 And as you create this Eni it will have its own security group.
01:49 And then of course EC2 will also have its own security group.
01:53 So for traffic to go from EC2 to this Eni, we need to add a SG outbound rule here in this security
02:01 group of EC2 and SG inbound rule for this any security group.
02:07 And further, of course, in order to receive the traffic from this EC2 instance connect endpoint,
02:12 you also need to have the inbound rule in this, uh, SG for EC2 that we already talked about in the
02:18 previous exercise.
02:20 So once we do that, then we should be able to access the EC2 instance over SSH.
02:26 First from the AWS console.
02:27 And from there it will be Https traffic to the SQS service endpoint.
02:32 And while we do that, we will also enable the private DNS for the SQS service so that we can access
02:39 SQS service endpoint without modifying the CLI command.
02:42 And I will also show you without enabling the DNS.
02:45 And after enabling the private DNS for SQS.
02:49 So that's the setup.
02:50 Uh and there are all these steps listed.
5. 实验实施步骤清单
时间范围：02:52–03:12
总结 / Summary
中文
实施顺序包括创建端点专用子网（endpoint subnet）、配置两个安全组（Security Groups）、创建 EC2 的 SQS IAM 角色（IAM role）、创建 SQS 队列、启动私有 EC2、建立 SQS Interface Endpoint，并分别验证禁用与启用 Private DNS 的行为。
English
The implementation sequence creates a dedicated endpoint subnet, configures two Security Groups, creates an SQS IAM role for EC2, creates an SQS queue, launches a private EC2 instance, creates an SQS Interface Endpoint, and tests behavior with Private DNS disabled and enabled.
Transcript
02:52 So if you want you can pause this video and read through this and can try to implement everything on
02:58 your own.
02:59 But otherwise let's implement this.
03:02 So here I will start with creating third subnet because I don't have that right now.
03:07 And then let's follow along the additional steps.
6. 创建 Endpoint 子网并关联路由表
时间范围：03:12–04:10
总结 / Summary
中文
在 Demo VPC 中创建 CIDR 为 10.10.2.0/24 的端点专用子网（endpoint subnet），并将其关联到现有私有路由表（private route table）。Interface Endpoint 不需要像网关端点（Gateway Endpoint）那样向路由表自动添加服务路由，但显式关联可避免误用主路由表（main route table）。
English
A dedicated endpoint subnet with CIDR 10.10.2.0/24 is created in the demo VPC and associated with the existing private route table. Unlike a Gateway Endpoint, an Interface Endpoint does not add a service route to the route table, but the explicit association avoids unintentionally using the main route table.
Transcript
03:12 Okay.
03:12 So as you can see here I already have two subnet one for EC2 instance connect and one for EC2 itself.
03:18 And now let's create subnet in the demo VPC.
03:22 And it should be the VPC endpoint subnet right.
03:30 As wise we will keep the traffic in the same AZ as EC2 so that there is no cross AZ data transfer charge.
03:37 And the subnet Cidr will be 10.10.2.0 24.
03:43 That's it.
03:43 Let's create the subnet.
03:45 And let's make sure that we are using the same route table for all these three subnets.
03:50 So there is already this demo private route table.
03:53 And there are only these two subnet associated.
03:56 So let's also add the subnet so that it doesn't use the main route table.
04:01 However, we are not going to change anything in the route table in this particular exercise because
04:05 that is required in the gateway endpoint, not for the interface endpoint.
7. 配置 EC2 与 Endpoint Security Groups
时间范围：04:10–06:01
总结 / Summary
中文
EC2 安全组（Security Group）允许来自 EC2 Instance Connect Endpoint 的 SSH 入站，并保留出站访问以完成验证。VPC Endpoint 安全组仅需入站 HTTPS 规则，可把源设置为 VPC CIDR，或更精确地引用 EC2 安全组；Endpoint ENI 无需额外出站规则。
English
The EC2 Security Group permits inbound SSH from the EC2 Instance Connect Endpoint and retains outbound access for the tests. The VPC endpoint Security Group needs only an inbound HTTPS rule whose source can be the VPC CIDR or, more precisely, the EC2 Security Group; the endpoint ENI needs no additional outbound rule.
Transcript
04:10 Okay.
04:10 Third subnet has been created.
04:12 Now let's create a couple of security groups.
04:15 So one for the EC2 instance.
04:17 So let's call it say create a new security group say EC2 for VPC endpoint demo SG.
04:31 And it should be in the demo VPC.
04:33 Now inbound traffic we need to allow the SSH traffic from the you know instance connect.
04:40 So let's keep it everywhere so that we don't have to change it.
04:44 And in the outbound traffic as well we need Https traffic going to the SQS service.
04:49 But I am keeping it all traffic because I also want to make sure that this instance doesn't have the
04:54 public connectivity to the internet.
04:57 So in order to test that we need to use ICMP protocol that is ping, and that's where I am keeping all
05:03 traffic.
05:03 Otherwise we could only use Https.
05:06 So that's it.
05:07 Let's create this security group.
05:09 And now let's create another security group for the VPC endpoint in itself.
05:15 So again let's create VPC endpoint security group.
05:25 And as I said it should only have the inbound traffic.
05:30 So let's add the inbound and it will be for Https traffic.
05:35 And the source will be EC2 instance.
05:37 So either we can put the VPC Cidr or 0000.
05:42 Anything should work.
05:44 Or we can even have the security group of EC2 instance.
05:47 So we can refer the security group.
05:49 As you know we could also do that.
05:51 Now outbound rule we don't really need so we can delete it.
05:55 And that's it.
05:56 Let's create this security group.
05:59 So we are done with the security group.
8. 为 EC2 创建 SQS IAM Role
时间范围：06:01–06:30
总结 / Summary
中文
创建供 Amazon EC2 使用的 IAM 角色（IAM role），并附加 Amazon SQS 完全访问权限（Amazon SQS Full Access）。该角色随后作为实例配置文件（instance profile）关联到实验 EC2。
English
An IAM role for Amazon EC2 is created with Amazon SQS Full Access. The role is then attached to the lab EC2 instance through its instance profile.
Transcript
06:01 Now IAM role we need to create that for EC2 instance to access the SQS service.
06:06 So let's create the role.
06:08 And this is for the EC2 instance.
06:10 And here the permission should be SQS full access.
06:15 And next.
06:17 So let's call it EC2 role for SQS for endpoint demo.
06:26 That's it.
06:26 And let's create the role okay that is done.
9. 创建 SQS Standard Queue
时间范围：06:30–07:10
总结 / Summary
中文
在亚太地区孟买区域（Asia Pacific Mumbai Region）使用默认设置创建标准队列（Standard Queue），并复制队列 URL（queue URL）。后续 AWS CLI 的 send-message 命令会使用该 URL 指定目标队列。
English
A Standard Queue is created with default settings in the Asia Pacific (Mumbai) Region, and its queue URL is copied. The AWS CLI send-message command later uses this URL to identify the target queue.
Transcript
06:30 Now also we need to create the SQS service itself or SQS queue itself.
06:36 In Asia Pacific Mumbai region there is already one queue.
06:40 So I can use it.
06:41 Or let's create a new one and it's a standard queue and let's call it say my queue.
06:50 That's it.
06:51 Nothing else needs to be done.
06:53 We are going with all the default things and let's create the queue.
06:57 Now for this queue there will be this endpoint URL of the Q using which we can send a message to the
07:03 q.
07:04 So we will need this endpoint URL.
07:06 So I'm copying it here.
07:08 Okay.
07:08 So q has been created as well.
10. 启动无公网 IP 的私有 EC2
时间范围：07:10–08:23
总结 / Summary
中文
在私有 EC2 子网中启动 Amazon Linux 实例，不分配公网 IP，并关联先前创建的 EC2 安全组（Security Group）和 SQS IAM 角色（IAM role）。Amazon Linux 已包含 EC2 Instance Connect Agent，便于通过 EC2 Instance Connect Endpoint 登录。
English
An Amazon Linux instance is launched in the private EC2 subnet without a public IP and with the previously created EC2 Security Group and SQS IAM role. Amazon Linux includes the EC2 Instance Connect Agent, allowing access through the EC2 Instance Connect Endpoint.
Transcript
07:10 Now let's launch the EC2 instance.
07:14 So let's go to the EC2 console in Asia Pacific Mumbai region.
07:18 Let's launch the instance.
07:20 Let's call it EC2 for VPC endpoint client.
07:26 Let's use Amazon Linux because it has EC2 instance connect agent installed already.
07:32 And here let's have the key pair.
07:37 And it should be in the demo VPC.
07:39 And it should be in the EC2 private subnet which is this.
07:44 And we don't need a public IP.
07:45 And we have to have the existing security group for EC2 which is this one.
07:53 And then in the advanced details let's select the IAM role that we had created.
07:58 Dated.
07:59 So EC2.
08:03 Roll for SQS I think.
08:06 Yeah this one.
08:08 And that's it.
08:09 Let's launch the instance.
08:15 Okay.
08:16 So instance has been launched.
08:18 Uh it's impending.
08:19 So let me pause this video for a minute and then let's connect to this instance.
11. 验证无互联网与 SQS 访问失败
时间范围：08:23–10:02
总结 / Summary
中文
通过 EC2 Instance Connect Endpoint 登录私有实例后，ping 公网和直接调用 SQS send-message 均失败。这验证了实例没有出站互联网连接，也尚未具备通向 SQS 的私有端点路径。
English
After connecting to the private instance through the EC2 Instance Connect Endpoint, both an Internet ping and a direct SQS send-message call fail. This confirms that the instance has no outbound Internet connectivity and no private SQS endpoint path yet.
Transcript
08:23 Okay.
08:24 So until now we just launched this EC2 with the IAM role.
08:27 And now we are connecting to this EC2 over this EC2 instance connect endpoint.
08:32 And we haven't really created this VPC endpoint for SQS.
08:36 So that will do little later.
08:38 But let's at least go to this EC2 and check if we have outbound internet connectivity, which is not,
08:45 but let's just verify.
08:48 Okay.
08:48 So let's go to this instance.
08:51 Say connect using the connect endpoint.
08:55 And let's connect.
09:00 Okay, I'm into the EC2 and now if we do say ping to google.com, of course it won't work because there
09:07 is no outbound connectivity.
09:09 And also let's try to, you know, make an API call to the SQS service, which also won't work.
09:15 But let's just make sure.
09:17 Now we need an CLI command for that.
09:19 So we can just go to the AWS CLI documentation.
09:22 And you can pick this command from there.
09:25 So I'm just doing the same.
09:28 And then we need a queue URL right.
09:31 So let's say dash dash queue URL and that URL that we had copied.
09:42 And then additionally we have to have the message body.
09:47 And we can say this is test message one and region.
09:52 It's AP South one.
09:58 And again, this won't work, of course, because there is no connectivity, right?
12. 创建禁用 Private DNS 的 SQS Endpoint
时间范围：10:02–11:15
总结 / Summary
中文
先在 VPC 设置中启用 DNS 主机名（DNS hostnames）和 DNS 支持（DNS support），随后为 SQS 创建 Interface Endpoint，选择专用 Endpoint 子网和允许 TCP 443 的 Endpoint Security Group，并暂时禁用私有 DNS（Private DNS），以观察端点专用 DNS 的行为。
English
DNS hostnames and DNS support are enabled on the VPC, then an SQS Interface Endpoint is created in the dedicated endpoint subnet with the endpoint Security Group permitting TCP 443. Private DNS is deliberately disabled first so endpoint-specific DNS behavior can be observed.
Transcript
10:02 So now let's create the VPC endpoint.
10:05 First we will have the private DNS disabled and let's see how it behaves.
10:10 So let's go to the VPC again.
10:13 So for this demo VPC let's go here edit VPC settings and enable both these settings and save it.
10:21 Now let's go back to the endpoint.
10:27 And let's create the endpoint.
10:29 So let's call it SQS endpoint.
10:34 SQS service.
10:37 In the demo VPC and we want to disable the private DNS.
10:41 And we want to create this in one of the AZ.
10:44 And we already had a subnet created for this endpoint which is this one right.
10:50 And with respect to the SG we want this VPC endpoint SG which allows the inbound 403 43 traffic.
10:59 Policy wise, it is very similar to the gateway endpoint policy, where it restricts access to a specific
11:05 VPC endpoint, but we are not doing that.
11:08 So let's create this endpoint and it will take again a minute.
11:13 So let me pause this video.
11:15 Okay.
13. 比较公共服务 DNS 与 Endpoint DNS
时间范围：11:15–12:17
总结 / Summary
中文
端点创建后会显示区域 DNS（Regional DNS）和可用区 DNS（Zonal DNS）。禁用 Private DNS 时，标准 SQS 服务主机名仍解析为公共 IP，而 Endpoint 专用 DNS 解析为 Endpoint ENI 的私有 IP，这可通过 nslookup 直接验证。
English
After creation, the endpoint exposes Regional and Zonal DNS names. With Private DNS disabled, the standard SQS service hostname still resolves to a public IP, while the endpoint-specific DNS name resolves to the private IP of the endpoint ENI, which can be verified with nslookup.
Transcript
11:15 So as you can see here the endpoint has been created.
11:18 And there are two DNS.
11:19 So this one is the DNS.
11:23 And this one is the basically the zonal because there is this AP South one A as a availability zone
11:30 name.
11:30 So we can use either of these DNS.
11:32 But let's copy this regional one as of now.
11:36 So everything is done.
11:37 Let's go back to the EC2 instance and let's see if we can still access the SQL service.
11:41 So what do we expect now?
11:44 It won't work because right now SQL service endpoint will resolve to the public DNS.
11:49 And we can verify that using Nslookup and SQS.
11:54 Dot AP South one dot Amazon aws.com.
12:01 And you see this is a public IP.
12:04 This is what we want.
12:05 But rather if you do nslookup for this VPC endpoint rather right.
12:11 This is a regional endpoint.
12:12 Then it resolves to the private IP which is the IP of the Eni.
12:16 Right.
14. 使用 endpoint-url 经 PrivateLink 发送消息
时间范围：12:17–13:22
总结 / Summary
中文
AWS CLI 命令增加 --endpoint-url 并指定 Endpoint 专用 DNS 后，流量可经 PrivateLink 抵达 SQS。首次尝试因缺少 HTTPS scheme 报错；补上 https:// 后消息发送成功，并可在 SQS 控制台轮询到第一条消息。
English
Adding --endpoint-url with the endpoint-specific DNS name lets the AWS CLI reach SQS through PrivateLink. The first attempt fails because the HTTPS scheme is missing; after adding https://, the message is sent successfully and appears when the queue is polled.
Transcript
12:17 So if you want to send a message using this DNS we have to use the same command.
12:22 But we have to add this additional parameter that is endpoint URL and just paste it there.
12:31 And if you do that you can see that it has worked.
12:35 But there is some problem which says the scheme is missing.
12:43 Okay.
12:43 So endpoint URL should also have the Https as a scheme.
12:50 It should be Https rather.
12:56 Right okay.
12:57 So the message has been sent to the queue.
12:59 So we can just go to the queue and verify that.
13:03 So this is a queue.
13:06 So go to the send or receive the message and poll for message.
13:10 And you can see there is this already a message.
13:13 Right.
13:13 That means it is working.
13:14 But what we really wanted is without having this additional endpoint URL, we should be able to send
15. 为 Endpoint 启用 Private DNS
时间范围：13:22–13:51
总结 / Summary
中文
通过 Endpoint 的 Modify private DNS name 设置启用私有 DNS（Private DNS），等待端点重新变为 Available。AWS 随后会让 SQS 标准服务主机名在该 VPC 内解析到 Interface Endpoint。
English
Private DNS is enabled through the endpoint's Modify private DNS name action, and the endpoint is allowed to return to Available. AWS then makes the standard SQS service hostname resolve to the Interface Endpoint inside this VPC.
Transcript
13:22 a message to the queue and how to do that.
13:25 So we learned that for that we have to enable the private DNS for the endpoint.
13:29 So let's go to the endpoint.
13:31 Let's go to the action and modify private DNS and enable for this endpoint.
13:38 Let's save the changes.
13:41 So it is pending.
13:42 So again let me pause this video for a minute.
13:45 Okay.
13:46 So you can see that endpoint is now available.
13:48 So let's again go back to the EC2 console.
16. 无需自定义 Endpoint URL 的成功验证
时间范围：13:51–14:32
总结 / Summary
中文
启用 Private DNS 后，nslookup 显示 SQS 标准服务主机名已经解析为 Endpoint ENI 的私有 IP。删除 --endpoint-url 后再次执行 send-message 仍成功，SQS 控制台显示第二条消息，证明应用无需修改即可透明使用私有路径。
English
After Private DNS is enabled, nslookup shows that the standard SQS service hostname resolves to the endpoint ENI's private IP. The send-message command succeeds again after --endpoint-url is removed, and the second message appears in the SQS console, proving that applications can use the private path transparently.
Transcript
13:51 And first let's try to resolve the this public endpoint of the SQS service.
13:57 And you see that it has now resolved to the private IP.
14:00 And this is what we wanted, which means we can now send the message to the queue without using that
14:06 endpoint URL.
14:08 Right.
14:08 So let's remove this.
14:12 And let's call it message number two.
14:17 And it works right.
14:18 We can very well verify that by going here and pull messages.
14:25 So this was the first one and this is the second one.
14:29 That means it works right as expected.
17. 清理计费资源
时间范围：14:32–14:59
总结 / Summary
中文
实验结束后应终止 EC2 实例并删除 VPC Endpoint。Interface Endpoint 按小时和数据处理量计费，及时清理可避免持续产生费用。
English
After the exercise, terminate the EC2 instance and delete the VPC endpoint. Interface Endpoints incur hourly and data-processing charges, so prompt cleanup prevents ongoing cost.
Transcript
14:32 So this is what we wanted to do in this exercise.
14:34 I hope it is clear.
14:36 Just before stopping make sure that you terminate your EC2 instance and you also delete your VPC endpoint
14:43 because there is a cost for the endpoint.
14:46 So let's delete that endpoint.
14:53 Okay.
14:53 So that's it about this exercise.
14:55 And now let's move to the next lecture.
14:57 Thank you.
整讲总结 / Overall Summary
中文
本讲完成了私有 EC2 访问 Amazon SQS 的端到端实验：创建专用 Endpoint 子网、安全组（Security Groups）、IAM 角色（IAM role）、SQS 队列和 Interface Endpoint；先验证 Private DNS 禁用时必须显式使用 endpoint-specific DNS，再启用 Private DNS，使标准 SQS 主机名透明解析到 Endpoint ENI 私有 IP。整个访问路径不依赖公网或 Internet Gateway。
English
This lecture completes an end-to-end lab in which a private EC2 instance accesses Amazon SQS. It creates a dedicated endpoint subnet, Security Groups, an IAM role, an SQS queue, and an Interface Endpoint. It first proves that endpoint-specific DNS must be supplied when Private DNS is disabled, then enables Private DNS so the standard SQS hostname transparently resolves to the endpoint ENI's private IP. The path requires neither public addressing nor an Internet Gateway.
返回顶部 ↑