How can a private app in your VPC/VNet reach a cloud service (e.g. S3 or Azure Storage) without going over the public internet?
Options
- With private endpoints: PrivateLink gives the service a private IP (Correct option)
- It is impossible, since cloud services are always public
- By disabling the firewall so that traffic can flow freely
- By giving the app a public IP and using the internet
Answer
Private endpoints: AWS PrivateLink / VPC endpoints and Azure Private Link give the service a private IP inside your network
Why
By default, calls to S3 or Azure Storage go to public endpoints. For security and compliance you can keep traffic on the provider's private network:
- AWS: VPC endpoints (Gateway endpoints for S3/DynamoDB, Interface endpoints through PrivateLink for many services).
- Azure: Private Endpoint (Private Link) that places a private IP of the service in your VNet.
Combined with firewall rules that block public access, data never crosses the internet.
Remember
Private endpoints = service reachable on a private IP.