Better understand inter-VPC vs. "public" traffic: Public IPs and PrivateLink Interface Endpoints

Lawrence

4/12/23, 6:15 PM

I'm trying to get a deeper understanding of traffic flows and routing in different scenarios when resources in a VPC are communicating with one another and with AWS Services. I recently came across this FAQ in the AWS docs and it threw a small wrench in my understanding:

Q. Does traffic go over the internet when two instances communicate using public IP addresses, or when instances communicate with a public AWS service endpoint?

No. When using public IP addresses, all communication between instances and services hosted in AWS use AWS's private network. Packets that originate from the AWS network with a destination on the AWS network stay on the AWS global network, except traffic to or from AWS China Regions.

Scenario 1: EC2 Instance <> EC2 Instance, Same VPC: Public IP Communication

It was my understanding that if two EC2 instances in the same VPC are communicating with one another via public IP addresses that the traffic will exit the VPC and traverse the "public internet", but maybe that doesn't mean outside of AWS's private network based on the FAQ above? Does anyone know at a deeper level what sort of exposure there is in this case, security wise? What does exiting the VPC really mean in terms of exposure and risks?

Scenario 2: EC2 Instance <> AWS Services Communication

I know AWS PrivateLink is used to "securely" connect to AWS Services from within a VPC. The following is taken from the docs regarding using PrivateLink and RDS:

Your instances also don't need public IP addresses to use any of the available RDS API operations. Traffic between your VPC and Amazon RDS doesn't leave the Amazon network.

Now, based on the first FAQ above it seems that when instances within a VPC are communicating with AWS Services via public endpoints/IPs (i.e. without PrivateLink interface endpoints) that traffic should never leave the Amazon network, but the PrivateLink docs make it seem like that the VPC traffic does possibly leave the Amazon network at some point if not using those interface endpoints?

I'm hoping someone can provide some clarity here as it seems like I need just a few more details to make everything click for me. I guess my concern/lens is focused on security and what sort of exposure there is / additional risk there is in each of the scenarios presented. What does traffic leaving the VPC really mean if it's all destined for the Amazon network at the end of the day? What are the risks of traffic leaving the VPC? Is it mostly a concern of denial of service or the possibility of people sniffing the traffic? Or something else? I know it probably depends on the threat model, but I'm curious what others are thinking about here in terms of risks/concerns.

Feel free to share any documentation/papers you found useful in understanding these things. The AWS docs seem a bit conflicting to me (or maybe they just don't go deep enough as it's getting into their secret sauce) so hoping there are some people that have done deeper dives in these areas and published something. I know there are lots of questions and concepts tied into this discussion so let me know if I can clarify/simplify my post above. Thanks in advance!

0 + 0

security

amazon-web-services

Tim

4/12/23, 7:11 PM

ENIs on instances only have private IPs, all traffic inside the VPC uses private. Translation to public IPs is done at the internet gateway. Traffic via endpoints doesn't leave the AWS network. I have no references for you, but I've been doing AWS a long time and I just covered this in my study for AWS architect pro recertification. Suggest you do the training for AWS network specialty to understand this better, but even architect associate will give you some information.

Lawrence

4/13/23, 4:06 AM

Thanks, I just read about the public IP translation at the Internet Gateway earlier today. Interesting! I was looking into the network and security speciality certs and think I might bite the bullet. While I'm generally not a fan of "certs" and don't know if I have bought into the value of them, I think the knowledge that can be gained from studying for them is very valuable.

Tim

4/13/23, 7:52 AM

You don't have to do the certification, but the training can be very valuable. Adrian Cantrill courses seem good for teaching, not just passing the exam.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Better understand inter-VPC vs. "public" traffic: Public IPs and PrivateLink Interface Endpoints

TH: ทำความเข้าใจระหว่าง VPC กับทราฟฟิก "สาธารณะ" ให้ดียิ่งขึ้น: IP สาธารณะและจุดสิ้นสุดของอินเทอร์เฟซ PrivateLink

RO: Înțelegeți mai bine traficul inter-VPC față de traficul „public”: IP-uri publice și puncte finale de interfață PrivateLink

RU: Лучшее понимание трафика между VPC и «общедоступного» трафика: общедоступные IP-адреса и конечные точки интерфейса PrivateLink

VI: Better understand inter-VPC vs. "public" traffic: Public IPs and PrivateLink Interface Endpoints

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.