1

I have two VPCs, a consumer VPC and a service VPC. Consumer application HAS to access the service via AWS PrivateLink and it HAS to be an HTTPS call. Here is my current setup, which works:

enter image description here

Note that since this is all on my own single account right now, I can set example.com to point to the VPC Endpoint, and I can add the cert for example.com to the Network Load Balancer. This allows me to call https://example.com from the consumer app and get all the way to the service.

However, in a real world scenario, the two VPCs would not be on the same account. I'm wondering how, in the latter scenario, HTTPS PrivateLink would be accomplished. If the service provider is in control of the domain, how would the consumer point that domain to the VPC endpoint? I found this but can't see the forest for the trees just yet:

Q: How do I make sure my customers can establish HTTPS connections to my service over VPC endpoints?

A: You will need to update your certificates to support wild card DNS names following the name pattern of VPC endpoints. If your service is using Amazon’s DNS names, we will provide you a certificate using Amazon Certificate Management service (ACM). If your service is using your own DNS names, you will need to update the certificate yourself.

Improve this question
5
  • 1
    I'd like to help, but I'm finding your question confusing and difficult to read.
    – Tim
    Jul 18, 2022 at 4:00
  • @Tim rewrote the question and added a diagram for clarification.
    – itstrueimryan
    Jul 18, 2022 at 6:02
  • 1
    NLBs do not support https, which is a layer 7 protocol, they only support TCP/TCPS which is a layer 4 protocol ( docs.aws.amazon.com/vpc/latest/privatelink/… ). The certificate goes on whatever is behind the NLB. This page says how to do private DNS as an alias to the endpoint AWS domain name ( docs.aws.amazon.com/vpc/latest/privatelink/… ). I haven't used PrivateLink myself but I suspect a read of the docs and a bit of experimentation and you'll work it out.
    – Tim
    Jul 18, 2022 at 9:43
  • According to this it should be doable: aws.amazon.com/premiumsupport/knowledge-center/…
    – itstrueimryan
    Jul 18, 2022 at 18:59
  • 1
    Yep this should be possible. Looks like the NLB does TLS and the servers sitting behind it do https.
    – Tim
    Jul 18, 2022 at 20:03

1 Answer 1

Reset to default
0

As mentioned in the comments, the answer is here: https://aws.amazon.com/premiumsupport/knowledge-center/privatelink-https-connectivity/.

It requires:

  • provider vpc owns domain example.com
  • provider vpc applies cert for example.com to NLB
  • consumer vpc creates private hosted zone for example.com with an A record that points to the VPC Endpoint.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .