Networking interview question · Most asked
How do private subnets reach AWS services like S3 without going over the internet?
Summary
Use VPC endpoints: gateway endpoints (free, route-table based) for S3 and DynamoDB, and interface endpoints (PrivateLink, an ENI with a private IP plus private DNS) for most other services. Azure uses Private Endpoints and service endpoints; Google Cloud uses Private Google Access and Private Service Connect.
Longer Answer
Benefits: traffic stays on the provider network, NAT data-processing costs drop, and endpoint policies can restrict access to your own buckets or accounts, which helps prevent data exfiltration.
Key Points
- Gateway endpoints for S3/DynamoDB.
- Interface endpoints for other services.
- Saves NAT cost.
- Endpoint policies limit access.
Deep dive: Networking Tutorial: Private Access to Cloud Services
Explanation
What interviewers look for
Knowing both endpoint types and the cost/security motivation.
More most-asked Networking questions
- How does NAT work, and what are its limits?
- What's the difference between TCP and UDP, and when would you choose UDP?
- What do 502, 503 and 504 errors from a load balancer usually mean?
- What is CIDR notation? How many usable addresses are in a /26, and in an AWS /26 subnet?
- How does DNS resolution work, and what does a record's TTL control?
- What does TLS provide, and how does certificate validation work?
- What happens, at the network level, when you type a URL into a browser and press Enter?
- What's the difference between stateful and stateless firewalls? Give cloud examples.