jajera · privatelink-conduit

PrivateLink Conduit

A runnable lab for cross-account AWS PrivateLink into a private 3-tier config API — same-Region and cross-Region — plus why New Zealand (ap-southeast-6) cannot join the cross-Region path today.

Deploy the lab See architecture

Three paths

Same-Region Sydney → Sydney

Sandbox consumer reaches the shared-services API in ap-southeast-2.

config.conduit.internal Cross-Region Melbourne → Sydney

Native cross-Region PrivateLink with supported_regions + service_region.

config-xr.conduit.internal Documented gap NZ is not available

ap-southeast-6 works same-Region only. Cross-Region is rejected in both directions.

no stack shipped

What this covers

The pattern. A consumer account reaches a private API in a provider account over PrivateLink — no peering, Transit Gateway, IGW, or NAT. One TCP port on one consumer ENI. The lab proves success ("source": "rds") and isolation (direct app/RDS IPs time out).

One provider, two consumers. Sydney serves Sydney in-Region and Melbourne across Regions on the same endpoint service.

Same-Region PrivateLink works in ap-southeast-6. Cross-Region does not, in either direction. Melbourne (ap-southeast-4) is the working cross-Region reference. Details: Cross-Region · Lab findings.

Read in this order

1. Architecture Topology, tiers, CIDRs, sample API 2. How PrivateLink works Roles, DNS, client IP, security groups 3. Cross-Region PrivateLink The two knobs and the Melbourne path 4. Lab findings: New Zealand What we observed for ap-southeast-6 5. Deploy and destroy Apply, prove (including isolation), tear down Troubleshooting Failure signatures and fixes Alternatives and limits What AWS cannot do; excluded workarounds Terraform reference File map for the three roots

Billable while running: RDS, NLB, interface endpoints, EC2 per stack. Follow teardown; destroy consumers before the provider.

Prerequisites in brief

• Terraform >= 1.5, AWS provider ~> 5.0
• Profiles shared-services and sandbox (different accounts)
• Session Manager plugin
• Melbourne path: both accounts opted into ap-southeast-4 (provider must opt in before listing it in SupportedRegions)

Full detail in the walkthrough.