Enterprise-Grade Security & Governance

26 — VPC Peering / Private Links

Connect agent workloads to private services through deliberately scoped network paths while retaining application authentication, encryption, and egress control.

Concept overview

Private connectivity keeps selected service traffic on private addressing and controlled network paths. VPC peering connects network address spaces, while private service endpoints expose particular services without granting broad network adjacency. These patterns solve different connectivity problems and should not be treated as interchangeable security guarantees.

A private route does not authenticate the caller, authorize a business action, or guarantee a provider's data-retention behavior. Keep TLS, workload identity, resource permissions, and data policy in place. Plan DNS, address ranges, routing, endpoint policies, and failure behavior together because a private endpoint that silently falls back to public resolution defeats the intended boundary.

Why it matters in production

Proof of concept

A prototype may call a public endpoint from a development network. Document the intended production traffic path before handling restricted data.

Production

Production provisions private DNS, restrictive routes and security groups, service authentication, and explicit egress rules. Verify the actual destination from the workload rather than trusting configuration alone.

Enterprise scale

At scale, account and region topology, endpoint costs, address overlap, and centralized DNS become design constraints. For AWS VPC peering, transitive peering is not supported; design routing accordingly.

Architecture components

Agent network segment

Hosts workloads under explicit inbound and outbound network policy.

Private endpoint or peering

Provides the chosen service-level or network-level connectivity boundary.

Private DNS resolver

Resolves service names to the intended private destinations consistently.

Workload identity

Authenticates the caller independently of its source network address.

Network observability

Records connection destinations, route failures, and unexpected public egress.

The architecture, mapped

Private inference connectivity with independent identity — Private addressing narrows network exposure while service identity and policy still govern requests.

flowchart LR
 A["Agent workload subnet"] --> D["Private DNS"]
 D --> E["Private service endpoint"]
 E --> S["Inference service"]
 I["Workload identity"] --> S
 P["Endpoint and egress policy"] --> E
 A --> F["Network flow evidence"]
 E --> F
 F --> M["Connectivity monitoring"]

Runtime flow

1
Classify traffic
Identify required services, data classes, regions, and permitted connection directions.
2
Choose topology
Select service endpoints or network peering based on the required reachability scope.
3
Configure resolution
Establish private DNS and test name resolution from the actual runtime environment.
4
Restrict paths
Apply routes, endpoint policies, security groups, and outbound destination controls.
5
Authenticate service
Use TLS and scoped workload identity for every protected application request.
6
Verify failure behavior
Break private connectivity in a controlled test and confirm that prohibited public fallback does not occur.

Connecting a clinical-document assistant to private inference

Healthcare technology · Illustrative enterprise scenario, not a reported customer outcome.

Business situation

A healthcare software provider processes restricted administrative documents in a controlled cloud environment.

The problem

A default SDK endpoint can send requests through public egress even after a private endpoint has been provisioned.

Agent requirement

The assistant must use the approved regional service path and authenticated workload identity.

Architecture

Private DNS resolves the inference hostname to a service endpoint, and network policy blocks unapproved outbound paths.

Runtime

The worker resolves the hostname, establishes TLS through the endpoint, and submits a minimized request using a scoped identity.
Connection telemetry verifies the private destination and associates the request with its approved region.

Failure scenario

If private DNS or the endpoint fails, the request returns a controlled service error instead of retrying through an unrestricted public hostname.

Operational impact

Measure unexpected egress, DNS failures, endpoint latency, and connection availability. Private connectivity does not by itself establish regulatory compliance or retention guarantees.

Architecture tradeoffs

Decision	Benefit	Cost
Service endpoints	Reachability can be limited to selected services.	Endpoint charges and provider-specific configuration add overhead.
Network peering	Multiple private services can communicate directly.	Broader adjacency and address planning increase complexity.
Strict no-fallback policy	The intended data path remains enforceable during failure.	Availability may fall when private connectivity is unavailable.

Failure scenarios & recovery

DNS resolves to a public address

Detect: Runtime resolution tests and flow logs reveal the unexpected destination.

Recover: Correct resolver configuration and block the public path.

Overlapping address ranges prevent routing

Detect: Connectivity validation identifies ambiguous routes.

Recover: Redesign addressing or use an appropriate service-level connection pattern.

Common architecture mistakes

Treating private IP addresses as authentication

Keep workload identity and resource authorization.

Assuming peering is transitive

Validate provider routing semantics explicitly.

Testing only endpoint creation status

Exercise real requests from production-equivalent subnets.

When to choose this pattern

Choose it when

Sensitive workloads require controlled service connectivity.
Private services span approved accounts or networks.
Network paths must be observable and enforceable.

Avoid it when

A public service with adequate controls meets all requirements.
The topology cost exceeds the actual isolation benefit.
Private routing is being used to replace application security.

Architecture checklist

Document service and network reachability scope.
Verify private DNS from runtime workloads.
Retain TLS and scoped identity.
Block prohibited public fallback.
Test region and address-range constraints.
Monitor destination paths after deployment.