Lecture 70: VPC Endpoint architectures - Accessing from peered or connected VPC
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：07:00
- 来源：Udemy Lecture 50324647
- Slide 数量：6
- 画面切换：00:53、03:09、04:24、06:23、06:37
扫描说明
逐条检查了 Udemy 页面中的 107 条 Transcript cue，并对全长约 07:00 的视频画面进行扫描。依据访问来源概览、跨 VPC L3/DNS、endpoint-url workaround、共享 Private Hosted Zone、命令示例和最终架构等阶段，共划分出 6 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 从其他网络访问 Interface Endpoint
时间范围：00:00–00:53
总结 / Summary
中文
Interface Endpoint 不仅能被所在 VPC 的客户端访问，也能服务于通过 VPC 对等连接（VPC Peering）、中转网关（Transit Gateway）、专线（AWS Direct Connect）或站点到站点 VPN（Site-to-Site VPN）连接的远程网络。本讲先讨论 AWS 内部的 Peered/Connected VPC 场景。
English
An Interface Endpoint can serve not only clients in its own VPC but also remote networks connected through VPC Peering, Transit Gateway, AWS Direct Connect, or Site-to-Site VPN. This lecture first focuses on peered or otherwise connected VPCs inside AWS.
Transcript
00:00 Okay.
00:01 Now let's look at how can you access VPC endpoint services from other networks like we have seen the
00:07 consumer VPC?
00:08 But what if that consumer VPC is connected to say, some remote networks like appeared VPC, right.
00:15 Or from the on premises network.
00:17 So how you can do that.
00:19 Now when it comes to accessing this VPC interface endpoints, there are typically two categories.
00:25 You can access it from within the AWS.
00:27 And what I mean by that.
00:29 If you have VPC interface endpoint in one of the VPC, can that interface endpoint be accessed from
00:35 the peered VPC.
00:37 Right.
00:38 So that you can centralize the VPC endpoint access.
00:42 Or what if your clients are there in the remote network, like in your on premises network.
00:48 So in both these cases let's see how end to end traffic flow works okay.
2. 跨 VPC 的 L3 Reachability 与 Endpoint DNS
时间范围：00:53–03:09
总结 / Summary
中文
Interface Endpoint 具有 ENI 和私有 IP，因此只要 VPC Peering 或 Transit Gateway 提供三层可达性（Layer 3 reachability），远程 VPC 就能直接访问 Endpoint IP。AWS 生成的区域/可用区 Endpoint DNS（Regional/Zonal Endpoint DNS）可在公网 DNS 中解析为这些私有 IP，因此远程客户端也能解析并使用它。
English
Because an Interface Endpoint has ENIs and private IPs, a remote VPC can reach those addresses whenever VPC Peering or a Transit Gateway provides Layer 3 reachability. AWS-generated Regional and Zonal endpoint DNS names are publicly resolvable to those private IPs, so remote clients can resolve and use them.
Transcript
00:53 So very first thing let's say you have a consumer VPC in which you have VPC endpoint.
00:58 And then you can access say Amazon S3 as a private service, and that is through interface endpoint,
01:04 not through the gateway endpoint.
01:05 And then you have your own VPC endpoint services as well.
01:09 And for that as well you have interface endpoint in the consumer VPC.
01:14 So until now we have been accessing the VPC endpoints from within the VPC right.
01:19 So you might have client in the central VPC itself.
01:23 But what if your clients are in different VPC.
01:26 Then can they access this VPC interface endpoint.
01:29 Now based on our discussion they can right.
01:32 Because VPC interface endpoint has the Eni and it has IP address.
01:37 So as long as this remote VPC is connected to this VPC over VPC peering connection or the transit gateway,
01:45 it can reach to this IP address and can access the target service.
01:51 So I hope that is clear right.
01:53 So of course the layer three connectivity works.
01:56 But what about the DNS resolution now.
01:59 That's really the important thing here to consider.
02:02 So let's talk about that.
02:04 Now you have this remote VPC and you have a client inside that.
02:08 Now if this client has to access S3 service privately through this VPC peering connection or transit
02:14 gateway, and then through the interface endpoint, how that traffic will look like.
02:19 So the first thing VPC endpoint will also have the DNS right.
02:24 That's a zonal and regional that we talked about.
02:27 And another thing to know is that this DNS can be resolved publicly.
02:31 That means even if this EC2 instance tries to resolve to this DNS, it will resolve to its private IP
02:37 address in this VPC.
02:39 So if there is a private connectivity, this EC2 ultimately can reach to the target service, right?
02:45 So using private IPS of VPC endpoint Enis or using the VPC endpoint DNS, this EC2 instance can access
02:53 these services.
02:54 So I hope it is clear.
02:56 But there is one problem.
02:58 So let's assume that you want to access axis for simplicity the S3 service through this interface endpoint.
03:04 Okay, so now we are talking about this client EC2 instance in the remote VPC.
3. Standard Service DNS 的问题与 endpoint-url Workaround
时间范围：03:09–04:24
总结 / Summary
中文
远程客户端若直接使用标准 S3 Service DNS，名称会解析到 S3 Public Endpoint，流量尝试经过 Internet Gateway；没有公网出口时请求失败。显式在 AWS CLI 命令中添加 --endpoint-url 并指定 Central VPC 的 Endpoint DNS 可强制走私有 ENI，但每条命令都修改 Endpoint URL 并不理想。
English
If the remote client uses the standard S3 service DNS name, it resolves to the public S3 endpoint and traffic attempts to use an Internet Gateway; without Internet egress, the request fails. Supplying --endpoint-url with the central VPC's endpoint DNS forces the request through private endpoint ENIs, but modifying every command is undesirable.
Transcript
03:09 So if it tries to say upload some data to S3 using this S3 URL, what will happen here is that the CLI
03:17 will hit the public S3 endpoint that is S3 dot whatever region dot Amazon aws.com.
03:23 And this resolves to the public IP of S3 endpoint.
03:26 That means traffic will be routed through the internet gateway.
03:30 If it is attached to this VPC, if there is no internet gateway, traffic doesn't reach to S3 endpoint.
03:38 So how do you solve this problem in the remote VPC?
03:42 So if you remember, we said that if you want to use the VPC endpoint DNS instead, you can add that
03:49 as an endpoint URL to your command.
03:51 So now on this EC2 instance, if you run this command then this endpoint URL DNS will resolve to the
03:58 private IP of the interface endpoint in the consumer VPC, and then traffic can privately go to the
04:04 S3 service.
04:05 Right.
04:06 So it will work.
04:08 But this is not desirable right.
04:11 You don't want every command to have this endpoint URL.
04:14 You actually want this first command to work.
04:17 And still the traffic should go privately to the S3.
04:21 Now how do you do that.
04:22 So let's look at that.
4. 自建并共享 Private Hosted Zone
时间范围：04:24–06:23
总结 / Summary
中文
AWS 自动创建的 Private Hosted Zone 只关联 Endpoint 所在 VPC，远程 VPC 无法使用。解决方法是禁用 Endpoint Private DNS，自建与服务公共主机名相同的 Route 53 私有托管区（Private Hosted Zone），用 Alias/CNAME 指向 Endpoint DNS，并把该 Hosted Zone 同时关联到 Central VPC 与 Remote VPC。远程客户端随后把标准 S3 名称解析到 Endpoint ENI 私有 IP，流量经 Peering/TGW 私有转发。
English
The AWS-managed Private Hosted Zone is associated only with the endpoint VPC and cannot be used by the remote VPC. The solution is to disable endpoint Private DNS, create a Route 53 Private Hosted Zone matching the service's public hostname, add an Alias or CNAME to the endpoint DNS, and associate the zone with both the central and remote VPCs. The remote client then resolves the standard S3 name to endpoint ENI private IPs and sends traffic privately over peering or the Transit Gateway.
Transcript
04:24 So the same architecture.
04:26 Now what if you enable the private DNS for this S3.
04:30 And in that case you know that there is a route 53 private hosted zone created.
04:35 And it would have this kind of alias record.
04:38 And then it will automatically be connected to the consumer VPC.
04:42 Right.
04:42 So this is connected to the consumer VPC.
04:45 But still this private DNS or hosted zone is not associated with the VPC.
04:52 So this remote VPC cannot still resolve this public DNS to the VPC endpoint DNS.
05:01 So that's still a problem.
05:03 So how do we solve that.
05:04 So for that what you should do is first you should disable the private DNS so that AWS does not create
05:12 that private hosted zone.
05:14 And which means that you should now create your own private hosted zone with the same name as S3 endpoint.
05:22 And in that private hosted zone, you should create an alias record or a CNAME record pointing this
05:28 S3 public DNS to the VPC endpoint DNS.
05:33 Now, because this is your own private hosted zone, and because there is another VPC, you can associate
05:40 this private hosted zone with this remote VPC, something like this.
05:46 And now because this VPC has the private hosted zone, now this EC2 instance when it makes the DNS request
05:53 for S3 dot AP South one dot Amazon Aws.com.
05:57 It will be resolved using this private hosted zone to the VPC endpoint DNS, and then VPC endpoint DNS
06:03 resolves to the private IP of the interface endpoint.
06:07 Something like this.
06:08 And then the traffic can flow from this EC2 instance to the interface endpoint to the S3 service.
06:14 And the same flow applies even if you have your own VPC endpoint services deployed here in this VPC.
06:21 Right.
06:22 So I hope it is clear.
5. DNS Query 与 Private Routing 示例
时间范围：06:23–06:37
总结 / Summary
中文
命令示例验证 Endpoint DNS 会解析为 Interface Endpoint ENI 的私有 IP；只要路由、安全组（Security Group）和网络 ACL（Network ACL, NACL）允许，数据包即可经私有连接到达 Central Endpoint，再转入 Amazon S3。
English
The command example verifies that endpoint DNS resolves to private IPs of the Interface Endpoint ENIs. Provided routing, Security Groups, and Network ACLs permit the flow, packets traverse the private connection to the central endpoint and then reach Amazon S3.
Transcript
06:23 And just to show you how exactly it works.
06:26 Now if you fire this command, the endpoint DNS will be resolved to the VPC endpoint Eni IP.
06:33 And then it will be routed privately to the S3.
6. Connected VPC DNS 架构总结
时间范围：06:37–07:00
总结 / Summary
中文
集中式 Endpoint 架构的关键不只是 IP 连通性，还包括 DNS 设计：Remote VPC 必须解析到 Central VPC 的 Endpoint ENI，而不是 AWS Service Public Endpoint。自建并跨 VPC 关联 Private Hosted Zone 能让应用继续使用标准服务主机名，同时保持 PrivateLink 私有路径。
English
A centralized endpoint architecture depends on DNS as much as IP connectivity: the remote VPC must resolve the service name to endpoint ENIs in the central VPC rather than to the public AWS service endpoint. A customer-managed Private Hosted Zone associated across VPCs preserves standard service hostnames while keeping the PrivateLink path private.
Transcript
06:37 Right.
06:37 So that's it about this DNS resolution.
06:40 Um, if you got it, how it works.
06:42 Congratulations.
06:43 But even if you did not get it completely, don't worry.
06:46 I don't expect this level of details into the exam, but it's always good to know how things work,
06:53 right?
06:53 So with that, we'll stop for this lecture.
06:55 And now let's look at some other architectures.
06:58 Thank you.
整讲总结 / Overall Summary
中文
本讲说明 Connected VPC 可以通过 Peering 或 Transit Gateway 访问 Central VPC 的 Interface Endpoint，但必须单独处理 DNS。Endpoint 专用 DNS 可直接解析私有 IP，标准 AWS Service DNS 则默认指向 Public Endpoint；为实现透明私有访问，应禁用托管 Private DNS，自建同名 Route 53 Private Hosted Zone，指向 Endpoint DNS 并关联所有使用者 VPC。
English
This lecture shows that connected VPCs can access a central Interface Endpoint over VPC Peering or a Transit Gateway, but DNS must be designed separately. Endpoint-specific DNS resolves directly to private IPs, whereas standard AWS service DNS normally points to the public endpoint. For transparent private access, disable managed Private DNS, create a matching Route 53 Private Hosted Zone that targets endpoint DNS, and associate it with every consumer VPC.
返回顶部 ↑