cloud networking — infographic

What "private" actually means across AWS, Azure, and GCP

"PrivateLink," "Private Link," and "Private Service Connect" all promise the same thing: reach a service in another VPC, account, or tenant without the public internet and without full VPC peering. The mechanism behind that promise is nearly identical across all three clouds — an interface object in your own subnet, paired with an internal software-defined fabric that does the real work of stitching networks together. Where they genuinely diverge is in the operational details below.

the shared primitive — how a packet actually moves

Interface in your subnet

ENI / NIC / forwarding-rule IP

Your client resolves the service's DNS name and gets back an address that lives inside your own subnet. No remote CIDR is ever involved — as far as your route table can tell, nothing left your network.

→

Hypervisor-level NAT

Hyperplane / Andromeda / Azure fabric

Below the OS, an internal SDN layer intercepts the connection and performs source + destination NAT, translating your local address into the path that actually reaches the provider's VPC.

→

Provider's internal LB

NLB / Standard LB / internal LB

Traffic lands on a private load balancer the service owner controls, which forwards to healthy targets. The provider never gets a route into your VPC — only this one inbound path.

No route table entry. No peering relationship. No CIDR overlap risk — because there's no route exchange to collide in the first place. Traffic never traverses an IGW, NAT Gateway, or the public internet at any point in this path.

why this design exists — star topology vs. peering mesh

VPC peering / VNet peering

Peering is route-table-based and pairwise. Every VPC that needs to reach every other VPC needs its own peering connection, and peering doesn't transit — if A peers with B, and B peers with C, A still can't reach C. At scale this becomes a full mesh you have to build and maintain by hand.

N networks → up to N(N−1)/2 connections

PrivateLink / Private Link / PSC

Because there's no routing relationship — just an interface endpoint resolving to a service — thousands of consumer VPCs can reach one provider service with zero peering connections and zero route table entries. The provider scales out the service; consumers just point at it.

N consumers → 1 service attachment

where the three implementations diverge

AWS

PrivateLink

Interface VPC Endpoint

VPC → ENI → Hyperplane

VPC

ENI

Hyperplane

Consumer primitive

Interface VPC EndpointOne ENI per subnet/AZ you select, each with a private IP from your own CIDR. This is the actual address your instance connects to — there's no remote hop visible.

Provider primitive

VPC Endpoint ServiceBacked by a Network Load Balancer for standard services, or a Gateway Load Balancer when the use case is inline inspection (firewalls, IDS appliances).

Fabric

HyperplaneAlso powers NLB and NAT Gateway — same substrate, shared failure domain.

gotcha

Security groups on the endpoint ENI and on the NLB target are both enforced — a double layer that's easy to misconfigure as a silent deny. Endpoint policies (IAM-style JSON) are a separate control plane from SGs entirely, so a request that clears the SG can still be rejected there. One thing that's not a gotcha anymore: cross-AZ data transfer through PrivateLink has been free since April 2022.

Azure

Private Link

Private Endpoint

VNet → NIC → Azure SDN

VNet

NIC

Azure SDN

Consumer primitive

Private EndpointA read-only NIC placed in your subnet, scoped to exactly one PaaS resource instance — one storage account, one SQL server, one Key Vault. Connections are strictly client-initiated; the service can never push back into your VNet.

Provider primitive

Private Link ServiceYour own service sits behind a Standard Azure Load Balancer; consumers connect through a Private Endpoint in their own VNet, gated by a connection-approval flow you control.

Fabric

Unnamed Azure SDN layerArchitecturally plays the same role as Hyperplane/Andromeda, just not publicly documented by name.

gotcha

DNS correctness is documented as the #1 cause of Private Link failures — usually on-prem DNS not forwarding the privatelink.* zones to Azure's resolver. NSG flow logs don't cover the endpoint NIC at all, leaving a visibility blind spot at exactly the point a security team would want it, until VNet flow logs close the gap (NSG flow logs retire Sept 2027).

GCP

Private Service Connect

PSC Endpoint / Backend

VPC → forwarding rule → Andromeda

VPC

Andromeda

Consumer primitive

Endpoint or Backend (NEG)An Endpoint is a forwarding rule with an internal IP — direct, simple. A Backend puts a PSC NEG behind your own GCP load balancer instead, buying custom domains/certs, consumer-controlled regional failover, and centralized access control that the other two clouds don't expose as cleanly.

Provider primitive

Service AttachmentPoints at an internal load balancer, and additionally requires a dedicated subnet (purpose=PRIVATE_SERVICE_CONNECT) sized for NAT — a capacity-planning step AWS and Azure don't surface as explicit config.

Fabric

AndromedaClient-side LB decision happens at the source host, packet gets wrapped in an Andromeda header naming the destination VPC, SNAT/DNAT happens on arrival at the destination host.

gotcha

Undersize the producer's PSC NAT subnet and you silently cap how many consumers can connect. GCP is also the only one of the three with a genuinely bidirectional primitive — PSC interfaces — letting the producer initiate connections back to the consumer, breaking the client-only assumption that holds on AWS and Azure.

The one thing to remember

Same primitive everywhere — interface in your subnet, hypervisor-level NAT, no route table involved. The differences that matter are at the edges: GCP adds a bidirectional mode and a producer-side NAT subnet to capacity-plan; Azure trades that flexibility for the sharpest DNS-dependency story of the three; AWS is the most "just works" once your SG-and-endpoint-policy intersection is wired correctly — which is itself the most common way to get it wrong.