- Learn AWS
- Architecture
- Private service access
Architecture pattern
AWS Private service access architecture
when traffic to AWS services must not cross the internet
A VPC endpoint gives a private route from your subnets to an AWS service, so private resources reach S3 or DynamoDB without a NAT Gateway or a public IP. Usually the answer when a compliance requirement appears in a networking question.
What it runs through
In the order a request or a record moves through it. Each one links to the page that explains it.
- ECS on FargateAmazon ECS on AWS Fargate
- VPC EndpointVPC Endpoint / PrivateLink
- S3Amazon S3
Signals in a brief that point here
Phrases that, when you meet them in a scenario, mean this shape rather than another. They are the tell, and they are what an exam question is built around.
- “must not traverse the internet”
- “private subnet”
- “compliance”
- “no public IP addresses”
What it costs you
One more piece of networking to get right, and endpoint policies are their own way to be locked out.
Every shape has one. A design decision with no stated downside is usually a decision nobody has finished making.
Learn the services in it
Shapes it is easily confused with
These run through some of the same services, which is exactly why a brief that fits one can look like it fits another.
Now build it from a brief
Reading a shape and producing one from a scenario that never names a service are different skills, and the exam asks for the second. The scenarios give you the brief; you draw the architecture and it is scored against what the brief requires.