Private Link

Your application in a private subnet needs to call the Stripe API to process a payment. The Stripe API lives on the public internet. So your traffic path looks like this: private instance to NAT Gateway to Internet Gateway, across the public internet to Stripe, and back. You pay NAT Gateway data processing fees ($0.045 per GB). Your traffic traverses the public internet, encrypted but still visible to network observers. And you add latency from the internet hop.

Now imagine Stripe's API were available inside your VPC, reachable via a private IP address in your own CIDR range. Your traffic would stay entirely on the cloud provider's backbone network. No NAT Gateway. No internet exposure. Lower latency. Lower cost.

That is exactly what PrivateLink does. It creates a private endpoint inside your VPC that connects to a service, whether that is an AWS managed service (S3, SQS, ECR, Secrets Manager), a third-party SaaS product (Datadog, MongoDB Atlas, Snowflake, Confluent), or another team's internal service running in a different VPC and a different AWS account. The traffic never leaves the cloud provider's network.

Snowflake, for example, recommends PrivateLink for all production deployments. Their documentation states that PrivateLink connections reduce query latency by 10-30% compared to public endpoints, purely from eliminating the internet hop.

PrivateLink has two sides:

Service provider side: The provider (AWS, a SaaS vendor, or your platform team) exposes their service behind a Network Load Balancer (NLB) and creates a VPC Endpoint Service. The NLB acts as the front door. The provider decides which AWS accounts are allowed to connect by accepting or rejecting endpoint connection requests.

Service consumer side: The consumer creates a VPC Endpoint (Interface type) in their VPC. This creates an Elastic Network Interface (ENI) in the consumer's subnet with a private IP from their own CIDR range. Route 53 resolves the provider's hostname to this private IP instead of a public one.

The result: from the consumer app's perspective, the provider service looks like any other private host inside the VPC. Security groups control access. No internet gateway required. No NAT Gateway in the path.

Endpoint types and costs:

The cost math matters. NAT Gateway charges $0.045/GB. PrivateLink charges $0.01/GB. If your private subnets pull 10 TB/month from ECR and S3, that is $450/month through NAT Gateway versus $100/month through PrivateLink. The savings compound fast in data-heavy architectures.

For S3 and DynamoDB specifically, use Gateway Endpoints. They are free and route traffic through the VPC route table rather than creating an ENI. No hourly cost, no per-GB cost. There is zero reason to use NAT Gateway for S3 access from private subnets.