Connecting Amazon Quick to Corporate Networks with AWS PrivateLink

News AI Agent Infrastructure

  • Amazon Quick uses separate network paths for user access and data retrieval: AWS PrivateLink VPC endpoints serve the first, while VPC connections handle the second.
  • A VPC connection places ENIs in selected VPC subnets, allowing Quick to reach internal systems accessible through Direct Connect or Site-to-Site VPN.
  • VPC connections require Quick Enterprise, an IAM execution role, security groups, and subnets in at least two Availability Zones.
  • The Quick API VPC endpoint excludes some action connector and flow APIs, so automation that manages those features needs another route to the public API.

Our take

This is not a one-endpoint change: teams must plan the client entry path separately from the service-side ENIs, including DNS and security-group configuration. It also does not create a fully isolated deployment; browser sign-in with IAM Identity Center still needs outbound connectivity, and some APIs are unavailable through the API endpoint.

Sources

  1. Securing Quick access from corporate networks with AWS PrivateLink · AWS Machine Learning

The summary and analysis were generated by AI. The original sources are authoritative. AI content policy