Amazon Onboarding with Learning Manager Chanci Turner

Learn About Amazon VGT2 Learning Manager Chanci Turner

on 18 FEB 2025

in Amazon Route 53, AWS PrivateLink, Networking & Content Delivery

Introduction

For large organizations implementing AWS PrivateLink interface endpoints, the main hurdles include streamlining deployment processes, reducing the number of endpoints, and optimizing costs at scale. A successful strategy to tackle these challenges is the use of AWS Transit Gateway in conjunction with Amazon Route 53 Resolver. This setup facilitates efficient sharing of AWS PrivateLink interface endpoints across multiple Amazon Virtual Private Clouds (VPCs) and on-premises environments. It allows businesses to decrease the number of necessary interface endpoints, leading to both cost savings and lowered operational overhead.

PrivateLink enables private connectivity between your VPC and supported AWS services, software as a service (SaaS) applications, or third-party services hosted on AWS or on-premises. It utilizes VPC Interface Endpoints, which create secure connections between your VPC and the target service. However, as organizations grow and add more VPCs and accounts, deploying these Interface Endpoints across thousands of VPCs—especially in multi-account environments—can become increasingly intricate and expensive.

The introduction of Amazon Route 53 Profiles offers an opportunity to reevaluate this architecture and enhance it further. By integrating Route 53 Profiles, you can simplify and centralize DNS management across numerous VPCs across multiple AWS accounts, making your PrivateLink deployment more scalable.

In this post, we will demonstrate how PrivateLink facilitates secure, private connectivity between your VPCs, whether they reside within the same account, across different accounts, or are integrated with on-premises environments and AWS services. Whether you are scaling your infrastructure or optimizing your architecture, this guide provides a practical, step-by-step approach for mastering PrivateLink deployments.

Solution Overview

Implementing a centralized deployment of PrivateLink in a hub-and-spoke model addresses the challenges associated with scaling PrivateLink across various VPCs and accounts. In the setup outlined in Figure 1, PrivateLink VPC endpoints are centralized and deployed within a Shared Services VPC. Spoke VPCs in Development and Production accounts can access these centralized endpoints by connecting to the Shared Services VPC through a Transit Gateway or AWS Cloud WAN. An on-premises data center can reach these centralized PrivateLink VPC endpoints by establishing hybrid connectivity with the AWS environment through AWS Direct Connect or AWS Site-to-Site VPN.

DNS Management

DNS management plays a vital role in executing a centralized deployment model. When creating a VPC Interface Endpoint for any PrivateLink-enabled service, you can enable private DNS by selecting the “Enable DNS name” option during the endpoint setup process. This feature creates an AWS-managed private hosted zone (PHZ) that resolves the public DNS name of the AWS service to the private IP address of the VPC Endpoint. However, this managed PHZ is limited to the hub VPC hosting the VPC Endpoint and cannot be shared with other spoke VPCs. To bypass this limitation, we employ custom PHZ, which we will detail in the following section.

Custom PHZ for PrivateLink DNS Resolution

For VPC-to-VPC and on-premises connectivity, we begin by disabling private DNS for the VPC endpoint.

1. In the VPC console, select Endpoints and choose the endpoint.
2. Click Actions and then Modify private DNS name.
3. Under Modify private DNS name settings, uncheck Enable for this endpoint.
4. Click Save changes.

Once private DNS names are disabled, you can create a Route 53 PHZ. Utilize the service endpoint name and configure an alias record that points to the AWS service’s VPC endpoint name.

In this instance, we are creating an endpoint for AWS Lambda in the us-east-1 AWS Region, which results in the endpoint ending with lambda.us-east-1.vpce.amazonaws.com. When this custom PHZ is established in the hub VPC, you can associate it with other spoke VPCs. This method ensures that all spoke VPCs can resolve the AWS service’s public DNS name to the private IP address of the endpoint, facilitating seamless connectivity across multiple VPCs.

Normally, to enable DNS resolution for VPC Endpoints across various VPCs, you would need to manually associate the PHZ with each VPC Endpoint for every spoke VPC. If both the hub and spoke VPCs are within the same AWS account, this association can be performed via the AWS Management Console. However, if the VPCs belong to different accounts, you would need to use the AWS Command Line Interface (AWS CLI) or SDK for the association. This process is outlined in the Route 53 developer guide.

To simplify and scale this process, Route 53 Profiles can be employed. In the next section, we will explore how Route 53 Resolver Profiles can enhance the existing solution.

VPC to VPC PrivateLink DNS Resolution Using Route 53 Profiles

The architecture diagram in Figure 5 illustrates a single-region workload. We have deployed Amazon VPCs named Dev VPC in a Development account and a Prod VPC in a Production account. As previously mentioned, these VPCs are connected using either Transit Gateway or AWS Cloud WAN. This architecture allows instances in either the Dev VPC or the Prod VPC to privately access Amazon Kinesis and Lambda through the VPC endpoint in the Shared Services VPC.

The following steps outline the deployment process and demonstrate how Route 53 Profiles streamline this process.

1. In the Shared Services VPC, we create VPC Interface endpoints to securely access Kinesis and Lambda using PrivateLink.
2. We configure PHZ for each of these endpoints.
3. We create a Route 53 Profile in the Shared Services Account and associate it with the Shared Services VPC.
4. Associate both the PHZ for Kinesis and Lambda with this Route 53 Profile.
5. To extend this newly created Route 53 Profile to the Dev and Prod accounts, we share the profile with both accounts using AWS Resource Access Manager (AWS RAM).
6. Once shared, navigate to the Dev and Prod accounts and associate the Route 53 Profile with each VPC in the respective accounts.

The implementation of VPC endpoints for Kinesis and Lambda ensures that all VPCs can resolve the public DNS names for these services to the corresponding private IP addresses of their respective VPC endpoints. As a result, all resources within these spoke VPCs can securely access Kinesis and Lambda services through either Transit Gateway or AWS Cloud WAN. This process is vital for organizations looking to scale their operations efficiently and effectively. For more information on this topic, consider reading about the importance of diversity in the workplace at SHRM, as well as checking out this excellent resource on Amazon’s training approach at Harvard Business Review. Finally, for those contemplating their next career move, the article on immediate resignation letters at Career Contessa offers insightful advice.

SEO Metadata