Cloud · AWS Core Services

AWS PrivateLink and VPC Interface Endpoints for data exfiltration defense

awsHardawsprivatelinkvpc-endpointssecurity

Interview question

How do you secure data lake traffic between private subnets and AWS services using PrivateLink and endpoint policies?

How to answer

The short answer

In enterprise organizations handling confidential healthcare, payment, or banking records, compliance standards forbid data lake pipelines from routing traffic over the public internet. At the same time, security policies must protect against internal data exfiltration where compromised EC2 instances or containers copy sensitive company data to unauthorized personal S3 buckets.

PrivateLink and VPC endpoints

AWS PrivateLink allows private subnets to communicate with AWS services and third-party SaaS applications entirely over the private AWS global network backbone without traversing the public internet.

AWS provides two types of VPC endpoints:

  • Gateway Endpoints: Supported specifically for Amazon S3 and DynamoDB. Gateway endpoints modify VPC route tables to point S3 traffic directly to private AWS storage backends. They incur zero hourly charges and zero data transfer costs.
  • Interface Endpoints: Supported for dozens of AWS services (including Glue, Secrets Manager, EMR, and Kinesis). Interface endpoints provision elastic network interfaces with private IP addresses directly inside your private subnets.

Exfiltration prevention with VPC endpoint policies

Attaching an endpoint secures network transport, but does not prevent malicious actors from uploading proprietary data to an external personal S3 bucket.

To eliminate this vulnerability, attach a restrictive VPC Endpoint Policy to the S3 endpoint:

JSON
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAccessToCorporateBucketsOnly",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::corporate-data-lake/*"
    }
  ]
}

With this policy active, any aws s3 cp command directed toward external buckets fails immediately at the network gateway layer, providing a secure perimeter around the corporate data estate.