Support sharing services through AWS PrivateLink

[efekarakus]

Ask

We'd like to expose Backend Services that are build in a separate account and VPC to other AWS accounts. One way of achieving a private connection from a different AWS account is through AWS PrivateLink.

One of the prerequisites for PrivateLink is creating a Network Load Balancer in front of the Backend Service so that it can be referred to from the VPC endpoint service.

The desired architecture should look like:

Proposal

In Backend Service Manifest, copilot can expose a way of placing a network load balancer in front of the shared ALB that is created for Backend Services.

name: api
type: Backend Service

http:
  path: '/'

nlb:
  port: 80/tcp
  target: http

This feature would add the nlb field just like for Load Balanced Web Services. However, in addition by specifying target: http we can have an ALB-type target group.

Request For Feedback

Would the feature description above be enough from Copilot to support AWS privatelink? It essentially only sets the prerequisites but doesn't help with creating an endpoint service or interface endpoint.

• How would you manage the endpoint service?
• How would you manage the interface endpoint?
• How about the custom DNS name for the endpoint service?