VPC Endpoints PrivateLink

Lets a private-subnet resource reach specific AWS services (S3, Bedrock, Secrets Manager) without ever going through a NAT Gateway or the public internet — but only works for AWS services (or PrivateLink-enabled SaaS), never for an arbitrary third-party API.

Why we need this / what value this brings

Keeps traffic to AWS services off the public internet entirely (lower latency, no NAT Gateway data-processing cost, tighter security posture) — but it's not a general-purpose internet-access solution.

When to use this

Only for calls to AWS services (or specific PrivateLink-enabled SaaS) from a private subnet — never for arbitrary third-party APIs like OpenRouter, which have no endpoint to connect to.

How to use or implement this

Check first whether the destination is an AWS service with an available VPC endpoint (S3, Bedrock, Secrets Manager, etc.) before defaulting to routing everything through NAT — for anything else (OpenRouter included), NAT Gateway is the only path.

Research questions

• Common trap: OpenRouter is not an AWS service, so no VPC endpoint exists for it — the NAT Gateway path is the only option, not PrivateLink.
• If the same app also calls Bedrock itself (not just OpenRouter), that call could go through a Bedrock VPC endpoint instead of NAT — worth separating which calls go where.

---

Empty folder — drop notes, links, and findings here as you research.