Accessing Amazon VPC Endpoints from On-Premises Environments
Publication date: March 25, 2022 (Diagram history)
This architecture uses AWS Transit Gateway to access interface Amazon VPC endpoints from on-premises environments. It uses AWS Direct Connect or AWS Site-to-Site VPN as transport between AWS and the corporate data center.
Accessing Amazon VPC endpoints from on-premises architecture
The following steps describe the data flow in this architecture:
-
A client in the corporate data center sends the request through the customer gateway. It resolves the DNS name to obtain the private IP address of the VPC endpoint.
-
The traffic sends to AWS Transit Gateway through an AWS Direct Connect link or an AWS Site-to-Site VPN connection.
-
The Transit Gateway on-premises route table forwards the traffic to the shared services VPC.
-
The Transit Gateway ENI forwards the traffic to the VPC endpoint.
The return path follows these steps:
-
The VPC endpoint sends the response back to the Transit Gateway ENI.
-
The traffic forwards to AWS Transit Gateway.
-
The Transit Gateway shared services route table sends the traffic to the corporate data center through the Direct Connect link or Site-to-Site VPN connection.
-
The response arrives at the on-premises client.
For more information about centralizing AWS PrivateLink endpoints with AWS Transit Gateway, see the Integrating AWS Transit Gateway with AWS PrivateLink and Amazon Route 53 Resolver
Further reading
For additional information, see the following resources:
Diagram history
To be notified about updates to this reference architecture diagram, subscribe to the RSS feed.
| Change | Description | Date |
|---|---|---|
Reference architecture diagram first published. | March 25, 2022 | |
Initial publication | Reference architecture diagram first published. | March 25, 2022 |
Note
To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.
