VPC endpoints, peering, Transit Gateway, VPN and IPv6

Service choices

Gateway endpoints provide private routing to supported services such as S3/DynamoDB without a NAT path. Interface endpoints create private interfaces using PrivateLink and require security-group/DNS planning. Endpoint policies further constrain access but do not grant IAM permissions on their own. VPC peering connects two non-overlapping networks and is not transitive. Transit Gateway provides hub-style routing at larger scale with attachment and route-table controls. Site-to-Site VPN encrypts connectivity over the internet; Direct Connect provides dedicated connectivity but is not automatically end-to-end encryption for all traffic.

S3 gateway-endpoint lab

1. Use an existing lab VPC and private subnet route table.
2. Create a gateway endpoint for the Region's S3 service and associate the intended route table.
3. Start with a deliberately scoped endpoint policy matching the bucket/operations in the exercise.
4. From a private instance with a valid role and suitable DNS/network setup, access a lab object.
5. Compare routing and logs before/after removing a NAT dependency for S3 traffic.

IPv6 concepts and lab

IPv6 uses 128-bit addresses. A globally routable IPv6 address does not automatically mean inbound access is allowed. Associate an IPv6 range with a supported VPC/subnet configuration, assign an address to a lab interface and configure routes/security rules. Use an egress-only internet gateway for outbound-only IPv6 internet initiation where appropriate; IPv4 NAT concepts do not map identically.

ip -6 addr
ip -6 route
curl -6 -I https://example.com

The last test requires an IPv6-capable destination and complete connectivity. Do not publish AAAA records for a site until its IPv6 path and TLS work.

Verify and troubleshoot

Check CIDR overlap, return routes, endpoint DNS, SGs/NACLs and authorization independently. A successful ping is not a successful database connection. Private DNS can change which address a service hostname resolves to; inspect from the actual workload, not only your laptop.

Assignment and cleanup

Draw allowed and denied paths for two VPCs plus an on-premises network. Remove lab interface endpoints and transit/VPN resources you no longer need; these can carry hourly/data charges.

Official references

VPC endpoints Transit Gateway

Interview and revision check

Why can an endpoint exist while an API call still fails?

DNS, routes, security groups, endpoint policy, IAM and resource policies all remain relevant. The endpoint alone does not authorize access.