VPC private access to Alibaba Cloud services-Virtual Private Cloud(VPC)-阿里云帮助中心

You can access Alibaba Cloud services such as OSS from a VPC over private networks instead of the Internet, improving security, network stability, and cost efficiency.

Private network access keeps all requests within the Alibaba Cloud internal network, providing stronger security, stable performance, and lower costs.

Two solutions are available: gateway endpoints and PrivateLink.

How it works

Gateway endpoint

PrivateLink

A gateway endpoint acts as a virtual gateway for a VPC to access a specific Alibaba Cloud service.

The following procedure uses OSS as an example:

When you create a gateway endpoint, select a VPC, a route table, and the Alibaba Cloud service to access.
After the gateway endpoint is created, the system adds a custom route entry to the selected route table. The destination is a system prefix list that contains the VIP CIDR blocks of OSS in the region, and the next hop is the gateway endpoint.
When an ECS instance in a vSwitch associated with the route table accesses the internal domain name of OSS, the VPC routes the request to the gateway endpoint. Traffic then reaches OSS over the private network, bypassing the Internet.

PrivateLink establishes a private tunnel between your VPC and the target service.

The following procedure uses OSS as an example:

To use PrivateLink, first create an interface endpoint. Select a VPC, a security group, a zone and vSwitch, and the Alibaba Cloud service to access.
After the interface endpoint is created, the system creates an endpoint elastic network interface (ENI) with a private IP address in each selected vSwitch. This endpoint ENI serves as the sole entry point for accessing the service.
When an ECS instance accesses the endpoint domain name and the traffic passes security group rules, requests route through the endpoint ENI to reach OSS over the private network, bypassing the Internet.

The following table compares the two solutions.

Feature	Gateway endpoint	PrivateLink
Use cases	Use endpoint policies together with OSS bucket policies to reduce the risk of unauthorized access and implement bidirectional authentication: Source control: The VPC can access only specified buckets. Destination control: The OSS bucket is accessible only from specified VPCs.	A standard solution for private access from a VPC to Alibaba Cloud services. Supports more service types and advanced capabilities than gateway endpoints.
Supported service types	Currently supports only OSS.	Supports many Alibaba Cloud services and user-created services, including services provided by ISVs.
VPC security capabilities	Supports only endpoint policies.	Supports security groups, network ACLs, and endpoint policies.
Networking capabilities	Does not support complex networking. May conflict with Alibaba Cloud service CIDR blocks (100.x.x.x/8).	Supports complex networking. Compatible with VPC peering, CEN, Express Connect, and VPN gateways for cross-region and hybrid cloud connectivity.
O&M capabilities	None	Supports flow logs for auditing and troubleshooting.
Fees	Free of charge.	Charges include instance fees and data transfer fees. For user-created services, you choose whether the consumer or provider pays.

Gateway endpoint

Use endpoint policies together with OSS bucket policies to reduce the risk of unauthorized access and implement bidirectional authentication:

Source control: The VPC can access only specified buckets.
Destination control: The OSS bucket is accessible only from specified VPCs.

Console

Create a gateway endpoint and configure a policy

The gateway endpoint's VPC, authorized bucket, and accessing user can belong to different Alibaba Cloud accounts.

Gateway endpoints are supported only in some regions.

Create a gateway endpoint and configure an endpoint policy.
1. Go to the VPC console - Gateway Endpoint page and click Create Endpoint.
2. Select a region and specify a name for the endpoint. Keep the endpoint type as Gateway Endpoint.
3. For Endpoint Service, select Alibaba Cloud Service, and then select the endpoint service for Object Storage Service (OSS).
4. Select a VPC and select a route table.
  After the gateway endpoint is created, the system adds a custom route entry to the selected route table. The destination is a system prefix list that contains the VIP CIDR blocks of OSS in the region, and the next hop is the gateway endpoint.
5. Configure an endpoint policy. The syntax is the same as the permission policy language of Resource Access Management (RAM).
  Policy example
  The following example allows only the user with the Account ID 1746xxxxxx to perform OSS-related operations on the bucket named examplebucket.
  { "Version": "1", "Statement": [ { "Effect": "Allow", "Action": "oss:*", "Resource": ["acs:oss:*:*:examplebucket", "acs:oss:*:*:examplebucket/*"], "Principal": ["1746xxxxxx"] } ] }
6. After the endpoint is created, you can find a system-added route entry in the custom route entries of the associated route table. The next hop points to the gateway endpoint.
Configure a bucket policy for OSS.
1. Go to the OSS console - Buckets page and click the name of the bucket that you want to authorize.
2. In the left-side navigation pane, choose Permission Control > Bucket Policy. Click Add by Syntax, and then click Edit.
3. Configure a bucket policy. The syntax is the same as the permission policy language of Resource Access Management (RAM).
  Policy example
  The following is a sample policy:
  Policy 1: Denies all accounts from performing OSS-related operations on the examplebucket bucket from any VPC except vpc-bp******.
  We recommend that you do not set Action to * in a Deny policy because this prevents even the bucket owner from accessing the bucket in the OSS console. OSS actions are listed in Overview of RAM policies.
  Policy 2: Allows only the user with the Account ID 1746xxxxxx to perform OSS-related operations on the examplebucket bucket from the VPC with the ID vpc-bp******.
  { "Version": "1", "Statement": [ { "Effect": "Deny", "Action": ["oss:ListObjects","oss:GetObject","oss:PutObject","oss:DeleteObject"], "Resource": ["acs:oss:*:*:examplebucket", "acs:oss:*:*:examplebucket/*"], "Principal": ["*"], "Condition": { "StringNotEquals": { "acs:SourceVpc": [ "vpc-bp******" ] } } },{ "Effect": "Allow", "Action": ["oss:*"], "Resource": ["acs:oss:*:*:examplebucket", "acs:oss:*:*:examplebucket/*"], "Principal": ["1746xxxxxx"], "Condition": { "StringEquals": { "acs:SourceVpc": [ "vpc-bp******" ] } } } ] }
4. After configuring the policy, click Save.
Verify the access policy.
Note: RAM users must have permissions on the relevant OSS buckets. Otherwise, access may fail.
1. Access from an authorized account to an authorized bucket within an authorized VPC succeeds.
2. Access fails if the account, VPC, or bucket is not authorized.

Modify an authorization policy

Modify an authorization policy to adjust permitted VPCs, buckets, or accounts.

To adjust authorized VPCs: Go to the OSS console - Buckets page, click the name of the target bucket, and choose Permission Control > Bucket Policy from the left-side navigation pane. Modify the Condition field in the existing policy to add or remove VPCs that can access the bucket.
To adjust authorized buckets:
1. Go to the VPC console - Gateway Endpoint page, click the ID of the target gateway endpoint instance, and select the Endpoint Policy tab. Modify the Resource field in the existing policy to add or remove buckets that the VPC can access.
2. Go to the OSS console - Buckets page, click the name of the target bucket, and choose Permission Control > Bucket Policy from the left-side navigation pane. Modify the Resource field in the existing policy to add or remove bucket resources that can be accessed. If multiple buckets are involved, you must perform this operation for each bucket.
To adjust authorized accounts:
Note: RAM users must have permissions on the relevant OSS buckets. Otherwise, access may fail.
1. Go to the VPC console - Gateway Endpoint page, click the ID of the target gateway endpoint instance, and select the Endpoint Policy tab. Modify the Principal field in the existing policy to add or remove accounts that can access buckets within the VPC.
2. Go to the OSS console - Buckets page, click the name of the target bucket, and choose Permission Control > Bucket Policy from the left-side navigation pane. Modify the Principal field in the existing policy to add or remove accounts that can access buckets within the VPC. If multiple buckets are involved, you must perform this operation for each bucket.

Associate or dissociate a route table

Associate or dissociate route tables to control which vSwitches can access Alibaba Cloud services through the gateway endpoint.

Go to the VPC console - Gateway Endpoint page and click the ID of the target gateway endpoint instance.
On the Associated Route Tables tab:
1. To associate a new route table, click Associate with Route Table. After the association is complete, you can find a system-added route entry whose next hop points to the gateway endpoint in the custom route entries of the associated route table.
2. To dissociate an existing route table, click Disassociate next to the target route table. After the dissociation, the system-added route entry is automatically removed.

Delete a gateway endpoint

To delete a gateway endpoint, you must first dissociate all associated route tables.

Dissociate all associated route tables.
Go to the VPC console - Gateway Endpoint page and click Delete to the right of the target gateway endpoint instance.
(Optional) Because the bucket policy remains in effect, other VPCs are still restricted from accessing the bucket. To adjust, go to the OSS console - Buckets page, click the target bucket, and choose Permission Control > Bucket Policy. Adjust or delete the policy that allows access only from the specified VPC.

API

Gateway endpoint:
1. To create a gateway endpoint and configure an endpoint policy, call the CreateVpcGatewayEndpoint operation.
  1. When you call this operation, you must specify the ServiceName parameter. You can call the ListVpcEndpointServicesByEndUser operation to query available endpoint services.
  2. The PolicyDocument parameter is used to configure an endpoint policy. The syntax is the same as the permission policy language of Resource Access Management (RAM).
2. Modify a gateway endpoint policy: Call the UpdateVpcGatewayEndpointAttribute operation and specify the PolicyDocument parameter.
3. Associate a route table: Call the AssociateRouteTablesWithVpcGatewayEndpoint operation.
4. Dissociate a route table: Call the DissociateRouteTablesFromVpcGatewayEndpoint operation.
5. Delete a gateway endpoint: Call the DeleteVpcGatewayEndpoint operation.
OSS bucket:
1. Configure a bucket policy for OSS: Call the PutBucketPolicy operation.
2. Modify a bucket policy: Call the PutBucketPolicy operation and specify the permission policy in JSON format.
3. Delete a bucket policy: Call the DeleteBucketPolicy operation.

Terraform

Configure a gateway endpoint:

Resource: alicloud_vpc_gateway_endpoint

Note: To delete a gateway endpoint, you must first dissociate all associated route tables.

provider "alicloud" {
  region = "cn-hangzhou"
}

resource "alicloud_vpc_gateway_endpoint" "default" {
  gateway_endpoint_name = "gateway-endpoint-name"        # The name of the gateway endpoint.
  service_name          = "com.aliyun.cn-hangzhou.oss"   # The name of the OSS service.
  vpc_id                = "vpc-bp******"                 # The ID of the VPC to which the gateway endpoint belongs.
  route_tables = ["vtb-bp******","vtb-bp******"]         # The IDs of the associated route tables.
  # The endpoint policy.
  policy_document       = <<EOF
   {
    "Version": "1",
    "Statement":
     [
       {
        "Effect": "Allow",
        "Action": "oss:*",
        "Resource": ["acs:oss:*:*:examplebucket","acs:oss:*:*:examplebucket/*"],
        "Principal": ["1746******"]
      }
    ]
  }
  EOF                                              
}

Configure a bucket policy for OSS:

Resource: alicloud_oss_bucket_policy

provider "alicloud" {
  region = "cn-hangzhou"
}

resource "alicloud_oss_bucket_policy" "default" {
  bucket = "examplebucket"  # The name of the bucket.
  
  policy = jsonencode({
    Version = "1"
    Statement = [
      {
        Effect = "Deny"
        Action = [
          "oss:ListObjects",
          "oss:GetObject",
          "oss:PutObject",
          "oss:DeleteObject"
        ]
        Principal = [
          "*"
        ]
        Resource = [
          "acs:oss:*:*:examplebucket",
          "acs:oss:*:*:examplebucket/*"
        ]
        Condition = {
          StringNotEquals = {
            "acs:SourceVpc" = [
              "vpc-bp******"  # Replace with your actual VPC ID.
            ]
          }
        }
      },{
        Effect = "Allow"
        Action = [
          "oss:*"
        ]
        Principal = [
          "1746xxxxxx"  # Replace with your actual Account ID.
        ]
        Resource = [
          "acs:oss:*:*:examplebucket",
          "acs:oss:*:*:examplebucket/*"
        ]
        Condition = {
          StringEquals = {
            "acs:SourceVpc" = [
              "vpc-bp******"  # Replace with your actual VPC ID.
            ]
          }
        }
      }
    ]
  })
}

PrivateLink

The following guides cover common PrivateLink scenarios:

Access Alibaba Cloud services: Access OSS over a private network by using PrivateLink.
Access user-created services (including services provided by ISVs): Access an ALB instance in another VPC by using PrivateLink and Access an NLB instance in another VPC by using PrivateLink.
Access network virtual appliances: Use GWLB to implement security inspection for IPv4 traffic.

More information

Billing

Gateway endpoints are free of charge.

PrivateLink billing: PrivateLink billing.

Supported regions

Area	Regions
Asia Pacific - China	China (Hangzhou), China (Shanghai), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Shenzhen), China (Ulanqab), China (Heyuan), China (Guangzhou), China (Chengdu), and China (Hong Kong)
Other Asia Pacific	Japan (Tokyo), Singapore, Malaysia (Kuala Lumpur), and Indonesia (Jakarta)
Europe and Americas	Germany (Frankfurt), UK (London), US (Silicon Valley), and US (Virginia)
Middle East	UAE (Dubai)

PrivateLink supported regions and zones: Regions and zones that support PrivateLink.

Quotas

Gateway endpoint quotas:

A VPC can be associated with only one gateway endpoint per Alibaba Cloud service, and a route table can be associated with only one gateway endpoint.
A single gateway endpoint can be associated with multiple VPC route tables.

PrivateLink quotas: Service quotas.