2

I have two VPCs, a consumer VPC and a service VPC. Consumer application HAS to access the service via AWS PrivateLink and it HAS to be an HTTPS call. Here is my current setup, which works:

enter image description here

Note that since this is all on my own single account right now, I can set example.com to point to the VPC Endpoint, and I can add the cert for example.com to the Network Load Balancer. This allows me to call https://example.com from the consumer app and get all the way to the service.

However, in a real world scenario, the two VPCs would not be on the same account. I'm wondering how, in the latter scenario, HTTPS PrivateLink would be accomplished. If the service provider is in control of the domain, how would the consumer point that domain to the VPC endpoint? I found this but can't see the forest for the trees just yet:

Q: How do I make sure my customers can establish HTTPS connections to my service over VPC endpoints?

A: You will need to update your certificates to support wild card DNS names following the name pattern of VPC endpoints. If your service is using Amazon’s DNS names, we will provide you a certificate using Amazon Certificate Management service (ACM). If your service is using your own DNS names, you will need to update the certificate yourself.

Ryan Bobrowski
  • 2,641
  • 3
  • 31
  • 52
  • 1
    I think you either have to create ACM Private CA (expensive), or setup self-signed certificates on your instances behind NLB, and use TCP (not TLS) to pass through all ssl traffic. – Marcin Jul 18 '22 at 03:28
  • There are [some posts](https://medium.com/@chamilad/adding-a-self-signed-ssl-certificate-to-aws-acm-88a123a04301) on adding self-signed certs to acm, so maybe can look into that as well. – Marcin Jul 18 '22 at 03:34

1 Answers1

0

The answer can be found here: https://aws.amazon.com/premiumsupport/knowledge-center/privatelink-https-connectivity/.

It requires:

  • provider vpc owns domain example.com
  • provider vpc applies cert for example.com to NLB
  • consumer vpc creates private hosted zone for example.com with an A record that points to the VPC Endpoint.
Ryan Bobrowski
  • 2,641
  • 3
  • 31
  • 52