Lecture 68: Other VPC endpoint types - Gateway Load Balancer, Resource, Service-network
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：06:42
- 来源：Udemy Lecture 50324639
- Slide 数量：5
- 画面切换：00:45、01:51、03:54、04:18
扫描说明
逐条检查了 Udemy 页面中的 103 条 Transcript cue，并对全长约 06:42 的视频画面进行扫描。依据标题、Gateway Load Balancer Endpoint、Resource Endpoint、Service-network Endpoint 与 VPC Lattice 架构的画面切换，共划分出 5 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 其他 VPC Endpoint 类型概览
时间范围：00:00–00:45
总结 / Summary
中文
除网关端点（Gateway Endpoint）和接口端点（Interface Endpoint）外，AWS 还提供面向特定场景的 Gateway Load Balancer Endpoint、资源端点（Resource Endpoint）和服务网络端点（Service-network Endpoint）。它们同样基于 PrivateLink 的私有连接原则。
English
Beyond Gateway and Interface Endpoints, AWS provides purpose-built Gateway Load Balancer Endpoints, Resource Endpoints, and Service-network Endpoints. They follow the same private-connectivity principles as PrivateLink.
Transcript
00:00 Okay, so until now we have seen two types of the endpoint.
00:03 One was VPC gateway endpoint to access S3 and DynamoDB specifically, and other was interface endpoint.
00:10 So all the exercises we recently did was all about the interface endpoint.
00:16 But lately AWS has also launched other types of endpoints which works on the same principle as the private
00:24 link.
00:24 So they are very much similar to the interface endpoint, but they have been created for special reason.
00:31 Right?
00:31 And in this short lecture, let's try to just go over that at very high level.
00:37 And further, we are going to dive deeper into these endpoints into their respective section in this
00:42 course.
00:42 Okay.
00:43 So there are other types.
2. Gateway Load Balancer Endpoint
时间范围：00:45–01:51
总结 / Summary
中文
网关负载均衡器端点（Gateway Load Balancer Endpoint, GWLBE）部署在应用 VPC 中，把需要检查的流量透明地发送到检查 VPC 的网关负载均衡器（Gateway Load Balancer, GWLB）。GWLB 再把流量分发给防火墙、入侵检测/防御系统（IDS/IPS）等网络虚拟设备（virtual appliances），检查后返回原流量路径。
English
A Gateway Load Balancer Endpoint (GWLBE) in an application VPC transparently sends inspected traffic to a Gateway Load Balancer (GWLB) in an inspection VPC. The GWLB distributes traffic to virtual appliances such as firewalls and IDS/IPS systems and returns the inspected traffic to its original path.
Transcript
00:45 And the first one is gateway load balancer endpoint.
00:47 And as the name suggests this endpoint is required to access the gateway load balancer.
00:53 And as you might already know, Gateway Load balancer is used to host or send traffic to your traffic
01:00 inspection appliances.
01:01 Okay.
01:02 So we have dedicated section on Gateway Load Balancer.
01:05 And there we'll dive a little deeper.
01:07 But ultimately what it means is that in the consumer VPC or in the application VPC, you can have this
01:14 gateway load balancer endpoint, which points to your inspection VPC, in which you have gateway load
01:20 balancer itself.
01:21 Right.
01:22 So this is how the architecture would be.
01:24 And further this gateway load balancer will send all the traffic that needs to be inspected to this,
01:30 um, network appliances.
01:32 And then traffic will come back.
01:34 And if there are any anomalies then it will be detected.
01:37 So for using the gateway load balancer you need this gateway load balancer endpoint.
01:43 So that's about it.
01:45 Now another type of the endpoint which is very new is resource endpoint.
3. Resource Endpoint 与 Resource Gateway
时间范围：01:51–03:54
总结 / Summary
中文
资源端点（Resource Endpoint）允许使用者 VPC 直接私有访问提供方 VPC 中的 RDS Database、单个私有 IP、IP 范围或 IPv6 地址，而无需 NLB。提供方创建资源配置（Resource Configuration）和资源网关（Resource Gateway），使用者创建 Resource Endpoint 连接；跨账户时通过资源访问管理器（AWS Resource Access Manager, RAM）共享 Resource Configuration。
English
A Resource Endpoint lets a consumer VPC privately access resources such as an RDS database, a private IP, an IP range, or an IPv6 address in a provider VPC without an NLB. The provider creates a Resource Configuration and Resource Gateway, and the consumer creates a Resource Endpoint. Across accounts, the Resource Configuration is shared with AWS Resource Access Manager (RAM).
Transcript
01:51 Now until now we saw the interface endpoint where we had VPC endpoint service hosted behind the network
01:57 load balancer.
01:58 And then we could access that using the interface endpoint.
02:02 But what if you have say AWS resource for example RDS database which is launched in a private subnet
02:09 in your VPC.
02:11 Now how to access that database directly from other VPC.
02:15 Now with the resource endpoint you can do that.
02:20 Okay.
02:20 So as you can see here in the provider VPC, you may have your database which is in private subnet not
02:26 accessible otherwise from the outside network.
02:28 Now if you want to access this database privately from this consumer VPC then you will create something
02:34 called resource configuration.
02:36 And if these VPCs are across different AWS accounts then you need to share this resource configuration
02:42 with this consumer account.
02:44 Further you have to create something called resource gateway which is a logical gateway basically.
02:49 And then you create a resource endpoint in the consumer VPC connecting to this resource gateway.
02:55 And once you do that you can then access this database using this resource endpoint from the consumer
03:02 VPC.
03:03 And for that we are going to talk about these resources or a resource gateway in VPC lattice section
03:10 because it's more relevant for that section.
03:13 But otherwise just understand that you can have this kind of private access to resources inside your
03:19 VPC.
03:20 And these resources need not be just database.
03:23 These resources could also be private IP for ranges from that VPC or IPv6 addresses.
03:30 And as you can see here, you don't need any NLB in the provider VPC as against the interface endpoint.
03:37 Now one thing to note is that if you want to do that across AWS account, then you need to share this
03:43 resource configuration using Resource Access Manager.
03:46 That is Ram, right?
03:48 So that's it about the resource endpoint.
03:50 I think this is good enough for you to know at this moment.
4. Service-network Endpoint 导论
时间范围：03:54–04:18
总结 / Summary
中文
服务网络端点（Service-network Endpoint）用于连接 VPC Lattice 服务网络（VPC Lattice Service Network）。本节只做高层介绍，后续 VPC Lattice 专章将深入讨论。
English
A Service-network Endpoint connects to a VPC Lattice Service Network. This lecture provides only a high-level introduction; a later VPC Lattice section covers the design in depth.
Transcript
03:54 Okay.
03:55 So the last type of endpoint that we want to discuss is service network endpoint.
03:59 And when we say service network it means VPC lattice service network.
04:05 Now we are having later a dedicated section for VPC lattice.
04:09 So at this moment let's try to just understand at a very high level because we are going to dive deep
04:15 into VPC lattice later.
04:17 Right.
5. 通过 Endpoint 访问 VPC Lattice Service Network
时间范围：04:18–06:42
总结 / Summary
中文
VPC Lattice 提供应用到应用网络（application-to-application networking），可把分布在多个 VPC 的服务注册到 Service Network。使用者 VPC 可直接关联 Service Network，或创建带 ENI 的 Service-network Endpoint；本地客户端、对等 VPC（peered VPC）、中转网关（Transit Gateway）网络，以及通过 VPN 或 AWS Direct Connect 连接的本地网络，都能通过该 Endpoint 访问 Lattice 服务。
English
VPC Lattice provides application-to-application networking by registering services from multiple VPCs with a Service Network. A consumer VPC can associate directly with the network or create an ENI-based Service-network Endpoint. Clients in the VPC, peered VPCs, Transit Gateway networks, and on-premises networks connected by VPN or AWS Direct Connect can then reach Lattice services through the endpoint.
Transcript
04:18 So VPC lattice is basically application to application networking.
04:22 So as you see on the right side there is a VPC lattice network.
04:26 And then you can have your VR services running across different VPCs.
04:30 And all these services register or say are shared through this VPC lattice network.
04:37 Now, if any consumer VPC wants to access any of those services, those consumer VPC needs to either
04:43 directly connect it to the service network, or you can create the VPC endpoint for this service network
04:50 in the consumer VPC.
04:52 Right.
04:53 And as you create that endpoint, then client in this VPC or client which are sitting on premises or
05:00 connected over to other VPCs can access your VPC lattice service network.
05:06 So this is how it works.
05:09 It creates Eni similar to the interface endpoint.
05:12 And through this Eni you can access the service network and which also means you can access other services
05:19 which are associated with this VPC lattice service network.
05:23 Now we are not showing on the right side all those services.
05:26 And as I said we will talk about that in the VPC lattice section.
05:31 So VPC endpoint of type service network connects VPC to this service network.
05:37 And now because this endpoint is a part of VPC and there is Eni, this Eni or the endpoint can also
05:45 be accessed from other networks.
05:47 Right.
05:48 So whether it's a peered VPC through the transit gateway or maybe a client sitting on premises and connected
05:55 over VPN or DX.
05:58 So that's what is the service network endpoint.
06:01 And all this traffic can flow to the VPC lattice network right.
06:06 So I hope it is clear.
06:07 So just to recap we talked about three more endpoint types.
06:12 First one was gateway load balancer endpoint.
06:15 Then there was a resource endpoint.
06:17 And now it is a service network endpoint for VPC lattice right.
06:22 So with that we'll stop for this lecture.
06:24 And now let's talk about some advanced architectures that emerge using the VPC private link.
06:30 And these are really important to understand.
06:32 If you work on VPC private link in your day to day job.
06:37 So let's now look at those advanced architectures.
06:40 So thanks for watching and stay tuned.
整讲总结 / Overall Summary
中文
本讲概览三种专用 Endpoint：GWLBE 把流量送往 GWLB 后的安全设备；Resource Endpoint 通过 Resource Gateway 直接访问 RDS、私有 IP 或 IP 范围且无需 NLB；Service-network Endpoint 则把 VPC 及其互联网络接入 VPC Lattice Service Network。三者分别解决流量检查、资源级共享和应用服务网络接入问题。
English
This lecture surveys three specialized endpoint types. GWLBE sends traffic to security appliances behind a GWLB; Resource Endpoints access RDS, private IPs, or IP ranges through a Resource Gateway without an NLB; and Service-network Endpoints connect VPCs and related networks to a VPC Lattice Service Network. They address traffic inspection, resource-level sharing, and application-service networking respectively.
返回顶部 ↑