#aws (2024-07)
Discussion related to Amazon Web Services (AWS)
Discussion related to Amazon Web Services (AWS)
Archive: https://archive.sweetops.com/aws/
2024-07-01
2024-07-02
2024-07-04
![Dhamodharan avatar](https://secure.gravatar.com/avatar/d22d4a23a167ba07fe9ad7e7708694e2.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0017-72.png)
Hi All, Seeking suggestions for a AWS POC,
Setting up a small AWS POC, planning to setup 1uat machine 1 prod machine and 1 Jenkins machine to build and deploy to both uat and prod.
To ensure the security, planning to go with aws organisation and keep 3accounts to keep all 3 servers. Is it good approach or any other approach to set it up? interms of security and cost effective.
Thanks in advance.
![theherk avatar](https://secure.gravatar.com/avatar/4741683a91497af9910946e555ebfe0e.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0022-72.png)
An account per machine, seems like more overhead than required for a POC, but in general this seems like a good separation. Using jenkins seems like a bummer.
![jenkins_ci](/assets/images/custom_emojis/jenkins_ci.png)
![Dhamodharan avatar](https://secure.gravatar.com/avatar/d22d4a23a167ba07fe9ad7e7708694e2.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0017-72.png)
We may be moving the same setup to live, so I am thinking this way..
![Dhamodharan avatar](https://secure.gravatar.com/avatar/d22d4a23a167ba07fe9ad7e7708694e2.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0017-72.png)
Also not sure about the costing with AWS, Is the aws accounts costs extra?
![theherk avatar](https://secure.gravatar.com/avatar/4741683a91497af9910946e555ebfe0e.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0022-72.png)
No. You pay per resource used.
![theherk avatar](https://secure.gravatar.com/avatar/4741683a91497af9910946e555ebfe0e.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0022-72.png)
Even organizations doesn’t cost extra, just the resources within the accounts attached to the organization.
![Dhamodharan avatar](https://secure.gravatar.com/avatar/d22d4a23a167ba07fe9ad7e7708694e2.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0017-72.png)
thanks for the info @theherk, I will implement the same approach then…
![managedkaos avatar](https://secure.gravatar.com/avatar/f7d88a7a95990c984ab107b491b51b3f.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0025-72.png)
For a POC… multiple accounts would be overkill.
However if your POC is to demonstrate account separation for a larger project, then yes, go for it. The org and the accounts are free.
I would think your breakout would be:
- Production account for all production resources
- UAT account for all non-production resources
- Deployment account for automation. one thing that would be really great to acheive with this set up is only allowing deployments into Production or UAT via the services in the deployment account. That is, no manual changes unless absolutely necessary.
Using the UAT account resources as a deployment target, you would also realize all you would need to do to allow access to the production account resources — VPCs, Security Groups, Systems Manager connections, etc — from the deployment account.
However, if your POC is to only demonstrate deploying from Jenkins into two “environments” (not accounts) then the multi-account approach is overkill.
![Dhamodharan avatar](https://secure.gravatar.com/avatar/d22d4a23a167ba07fe9ad7e7708694e2.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0017-72.png)
hi @managedkaos thanks for the response, We would move the same setup to live if everything is good. So i thought this approach in that longrun. By keeping that in mind, hope this approach is good? Or you are suggesting some other option?
![managedkaos avatar](https://secure.gravatar.com/avatar/f7d88a7a95990c984ab107b491b51b3f.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0025-72.png)
Your approach is good, indeed! Not suggesting another option.
2024-07-05
![Sairam avatar](https://secure.gravatar.com/avatar/5c982183eb607e24d1c6b7bc01cd2821.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0025-72.png)
Hi Everyone, need help in python runtime upgrade in aws lambda, I have deployed datadog as aws lambda application with python runtime as 3.7 a while ago. Have a lot of env vars in it. How do we upgrade the application with python 3.11 runtime. thanks in advance.
I did try by just manually upgrading the lambda function runtime to python3.11 but it breaks
![theherk avatar](https://secure.gravatar.com/avatar/4741683a91497af9910946e555ebfe0e.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0022-72.png)
When you say it breaks, what do you mean. It might be that your code needs some changes to work with 3.11.
![Sairam avatar](https://secure.gravatar.com/avatar/5c982183eb607e24d1c6b7bc01cd2821.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0025-72.png)
thanks for the reply. I get the below error. I used https://github.com/DataDog/datadog-serverless-functions/tree/master/aws/logs_monitoring#<i class="em em-~~~"https://github.com/DataDog/datadog-serverless-functions/tree/master/aws/logs_monitoring#:~~~ext=tabs%20%3E%7D%7D%20%[…]dFormation,-Log%20into%20your for installation.
[ERROR] Runtime.ImportModuleError: Unable to import module 'lambda_function': cannot import name 'formatargspec' from 'inspect' (/var/lang/lib/python3.11/inspect.py)
Traceback (most recent call last):
![theherk avatar](https://secure.gravatar.com/avatar/4741683a91497af9910946e555ebfe0e.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0022-72.png)
See What’s new in Python 3.11. With respect to formatargspec
:
The formatargspec() function, deprecated since Python 3.5; use the inspect.signature() function or the inspect.Signature object directly. And since that guide you shared says to use Python 3.10, perhaps you should. That would be before a feature it is using was removed. And once it imports it will pass, and maybe (probably) succeed at importing
lambda_function
which I presume is your entry point.
Editor, Pablo Galindo Salgado,. This article explains the new features in Python 3.11, compared to 3.10. Python 3.11 was released on October 24, 2022. For full details, see the changelog. Summary –…
![theherk avatar](https://secure.gravatar.com/avatar/4741683a91497af9910946e555ebfe0e.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0022-72.png)
I just stumbled across that tab again and noticed it list varying runtime requirements based on the version you’re running. So while it says “Create a Python 3.10 Lambda function”, the version here is actually based upon version. So if you run version Upgrade an older version to +3.107.0 it would support Python 3.11, meaning it probably won’t try to import formatargspec
.
![Sairam avatar](https://secure.gravatar.com/avatar/5c982183eb607e24d1c6b7bc01cd2821.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0025-72.png)
Thanks, even I think upgrading the datadog application itself helps rather than i only upgrade the python runtime alone.
![Sairam avatar](https://secure.gravatar.com/avatar/5c982183eb607e24d1c6b7bc01cd2821.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0025-72.png)
I will keep you posted
![Sairam avatar](https://secure.gravatar.com/avatar/5c982183eb607e24d1c6b7bc01cd2821.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0025-72.png)
Hi, Post upgrade of the datadog application, I get this error
[ERROR] 2024-07-11T15:51:44.602Z 2d1a12b4-8337-4fec-af18-7aebda4d3a58 [dd.trace_id=597347809750705622 dd.span_id=5039695315866320206] Failed to get log group tags from cache
Traceback (most recent call last):
File "/opt/python/caching/cloudwatch_log_group_cache.py", line 125, in _get_log_group_tags_from_cache
response = self.s3_client.get_object(
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lang/lib/python3.11/site-packages/botocore/client.py", line 553, in _api_call
return self._make_api_call(operation_name, kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lang/lib/python3.11/site-packages/botocore/client.py", line 1009, in _make_api_call
raise error_class(parsed_response, operation_name)
botocore.errorfactory.NoSuchKey: An error occurred (NoSuchKey) when calling the GetObject operation: The specified key does not exist.
Please suggest what is it? Thanks in advance
![theherk avatar](https://secure.gravatar.com/avatar/4741683a91497af9910946e555ebfe0e.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0022-72.png)
Looks like you’re going to need to troubleshoot why that key isn’t there or why your lambda can’t see it.
![Sairam avatar](https://secure.gravatar.com/avatar/5c982183eb607e24d1c6b7bc01cd2821.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0025-72.png)
This is part of the baseline code of the Datadog Forwarder.
According to that method, it handle that exception. Im not sure how to add the key… before upgrading there was no issue
response = self.s3_client.get_object(
2024-07-08
2024-07-11
2024-07-15
![Prasad avatar](https://secure.gravatar.com/avatar/d10f160b2be0fcd3fb6dfcafa2cebae6.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0022-72.png)
I have a ALB in a source acct routing to a NLB in a target account at the moment …we have a use case to have Private Link setup from another source account …can the endpont link be setup with the same NLB in target account by creating endpoint service.. i want both routes to work
![Gabriela Campana (Cloud Posse) avatar](https://avatars.slack-edge.com/2023-05-17/5281506983315_fbbf3b358313efef4647_72.jpg)
@Jeremy White (Cloud Posse)
![Jeremy White (Cloud Posse) avatar](https://avatars.slack-edge.com/2022-10-14/4236950492513_ceab13cebd77d26f2ef6_72.jpg)
I don’t immediately see why that wouldn’t work. I don’t recall ever having that same scenario, however.
![Prasad avatar](https://secure.gravatar.com/avatar/d10f160b2be0fcd3fb6dfcafa2cebae6.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0022-72.png)
2024-07-19
![Sean Turner avatar](https://secure.gravatar.com/avatar/d65e20d489479e9ae2dfdd00d0393855.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0012-72.png)
Hey all, curious what you all think.
Jupyterhub Notebooks on EKS has a worst case scenario cold start where a Data Scientist needs to wait for a Node to spin up and for the large Docker Image to pull.
The thinking is that we can largely eliminate (or at least reduce) the Docker Image pull time by creating AMIs with the Docker Image on them (with Image Builder pulled as ec2-user). Jupyterhub would then launch workloads (notebook servers) onto these AMIs as Nodes managed by Karpenter with Taints/Tolerations and Node Affinity.
However, it seems like ec2-user
and the kubelet (or containerd?) have different docker storage (there’s only one EBS volume attached). This is causing EKS to pull images that should already be available to it because the image was previously pulled by ec2-user
.
Running a docker images
command run on the node (via SSH as ec2-user) shows a couple our latest
tag which was pulled while building the AMI. Launching a Notebook with a specific tag “foo” caused a docker pull to occur. When it was finished, running docker images
via SSH again did not show foo
in the output.
Conversely, pulling a different tag bar as ec2-user
and then launching a Notebook Server with bar caused EKS to pull the Image again.
Any ideas?
![Sean Turner avatar](https://secure.gravatar.com/avatar/d65e20d489479e9ae2dfdd00d0393855.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0012-72.png)
Interesting, looks like the Images are in the output of ctr -n [k8s.io](http://k8s.io) images list
. Seems like I’ll need to get Image Builder to pull my image to that namespace with ctr
![Sean Turner avatar](https://secure.gravatar.com/avatar/d65e20d489479e9ae2dfdd00d0393855.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0012-72.png)
This is the solution I came up with. Haven’t tested it yet (as in launched a notebook) but I think it works (it’s pulling my image successfully to the same namespace that EKS uses)
phases:
- name: build
steps:
- name: pull-machine-prospector
action: ExecuteBash
inputs:
commands:
- password=$(aws ecr get-login-password --region us-west-2)
# Redirecting stdout because the process creates thousands of log lines.
- sudo ctr --namespace k8s.io images pull --user AWS:$password acct.dkr.ecr.us-west-2.amazonaws.com/app:latest > /dev/null
- sudo ctr --namespace k8s.io images list
- name: test
steps:
- name: confirm-image-pulled
action: ExecuteBash
inputs:
commands:
- set -e
- sudo ctr --namespace k8s.io images list | grep app
![Sean Turner avatar](https://secure.gravatar.com/avatar/d65e20d489479e9ae2dfdd00d0393855.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0012-72.png)
Didn’t seem to work, image still needed to pull.
2024-07-23
![Yangci Ou avatar](https://avatars.slack-edge.com/2024-08-02/7543124069696_1e6b203795941b5f2e2c_72.jpg)
Hey guys, I see that CloudPosse prefers using Ecspresso as the ECS cli tooling. I’m curious to hear why that’s the case, and what do you look for? - and if there’s benefits y’all see in using this versues other tools like ecs-deploy , or even plain AWS commands as a script as as this https://github.com/silinternational/ecs-deploy/tree/develop? From what I’m seeing, ecspresso definitely has better task definition control.
![Gabriela Campana (Cloud Posse) avatar](https://avatars.slack-edge.com/2023-05-17/5281506983315_fbbf3b358313efef4647_72.jpg)
@Ben Smith (Cloud Posse) @Igor Rodionov
![Erik Osterman (Cloud Posse) avatar](https://secure.gravatar.com/avatar/88c480d4f73b813904e00a5695a454cb.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0023-72.png)
Sorry for the delay, I meant to share this thread: https://archive.sweetops.com/aws/2024/04/#019d7c5e-1226-4a6b-ac03-5f4af8968f7d
SweetOps Slack archive of #aws for April, 2024. Discussion related to Amazon Web Services (AWS)
![Erik Osterman (Cloud Posse) avatar](https://secure.gravatar.com/avatar/88c480d4f73b813904e00a5695a454cb.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0023-72.png)
TL;DR: we’re still looking for the silver bullet
![Erik Osterman (Cloud Posse) avatar](https://secure.gravatar.com/avatar/88c480d4f73b813904e00a5695a454cb.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0023-72.png)
:crossed_fingers: for AWS copilot
CLI for ECS
![Erik Osterman (Cloud Posse) avatar](https://secure.gravatar.com/avatar/88c480d4f73b813904e00a5695a454cb.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0023-72.png)
We’ve had multiple iterations of our solution for ECS, and ecspresso
is pretty nice. We chose it over other tools because it’s compiled as a single binary, easy to install, supports task definition templates out of the box, works with data sources to fetch data used in templates
![Erik Osterman (Cloud Posse) avatar](https://secure.gravatar.com/avatar/88c480d4f73b813904e00a5695a454cb.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0023-72.png)
Most of the family of ecs-deploy
commands (there’s probably a half dozen or more) are scripts (shell, python, etc)
![Erik Osterman (Cloud Posse) avatar](https://secure.gravatar.com/avatar/88c480d4f73b813904e00a5695a454cb.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0023-72.png)
Escpresso also has a nice YAML-based configuration.
![Erik Osterman (Cloud Posse) avatar](https://secure.gravatar.com/avatar/88c480d4f73b813904e00a5695a454cb.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0023-72.png)
In the long run, want to see this win: https://aws.github.io/copilot-cli/
Develop, Release and Operate Container Apps on AWS.
![Yangci Ou avatar](https://avatars.slack-edge.com/2024-08-02/7543124069696_1e6b203795941b5f2e2c_72.jpg)
Oooh yeah the copilot CLI is interesting, was looking at it earlier and it manages everything so having custom stuff through Terraform might be hard.
![Yangci Ou avatar](https://avatars.slack-edge.com/2024-08-02/7543124069696_1e6b203795941b5f2e2c_72.jpg)
because it’s compiled as a single binary
This is a nice one
2024-07-24
2024-07-27
2024-07-29
2024-07-31
![Dexter Cariño avatar](https://avatars.slack-edge.com/2023-06-05/5400884825136_5cf83f6cf35786761666_72.png)
any body here have an idea on how to get the live data of dynamodb? planning to stream the data from dynamodb to bigquery or dynamodb to s3 to bigquery.
any insights or idea without using a third party tool. thank you so much.
![Darren Cunningham avatar](https://secure.gravatar.com/avatar/d0ea359c3ff6b8093ae53e57fbbe2570.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0022-72.png)
I know you said without using a third party tool, but I’d suggest considering Airbyte for the job rather than rolling your own. Otherwise the “simplest” solution is probably DynamoDB Streams -> Lambda. CDC/ETL jobs have a ton of different factors though (why Snowflake is named what it is), so it’s going to be hard for those without intimate knowledge thereof to be accurate. Aka, I could be wrong.
![Gabriela Campana (Cloud Posse) avatar](https://avatars.slack-edge.com/2023-05-17/5281506983315_fbbf3b358313efef4647_72.jpg)
@Jeremy White (Cloud Posse)
![Jeremy White (Cloud Posse) avatar](https://avatars.slack-edge.com/2022-10-14/4236950492513_ceab13cebd77d26f2ef6_72.jpg)
I’d second that. Using a lambda is the easiest way. You could also try using a PITR with s3 export but there will be a lag time during which any deletes/updates to the data being restored would potentially get dropped. Being careful of that might work best, but again it has the risk of data integrity loss.
DynamoDB offers a fully managed solution to export your data to Amazon S3 at scale. This allows you to perform analytics and complex queries using other AWS services like Amazon Athena, AWS Glue, and Amazon EMR. Exports can be full or incremental, and are charged based on the size of the data. Your data is encrypted end-to-end, and you can export to an S3 bucket owned by another AWS account or Region.
![Dexter Cariño avatar](https://avatars.slack-edge.com/2023-06-05/5400884825136_5cf83f6cf35786761666_72.png)
thank you so much for your insights. cheers!
![shayyanmalik13 avatar](https://secure.gravatar.com/avatar/62d4833ac2d048f0f0e870f613db5bb7.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0010-72.png)
Hi hi, anyone here uses prometheus thanos grafana stack? I have 4 AWS envs (different accounts) and want to set up prometheus in all these envs but only one thanos and grafana. Trying to see what the industry standard is for connecting it all together. Vpc peering or transit gateways seem insecure.
![Joe Perez avatar](https://avatars.slack-edge.com/2022-11-09/4361990079457_b06c12666181bb7ec599_72.jpg)
I’m not familiar with this set up, but privatelink might be what you’re looking for. The service provider being the Thanos installation inside that separate VPC/AWS account and each of the Prometheus VPCs/Accounts being service consumers
![shayyanmalik13 avatar](https://secure.gravatar.com/avatar/62d4833ac2d048f0f0e870f613db5bb7.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0010-72.png)
Got it. I just looked at privatelink and you’re right, it does allow specific resource exposure. But wouldn’t it also share the same security concerns as VPC peering for this specific use case because prometheus will be running on the same eks cluster as my app. So if I share this cluster through privatelink, app still gets exposed to other environments?
![Joe Perez avatar](https://avatars.slack-edge.com/2022-11-09/4361990079457_b06c12666181bb7ec599_72.jpg)
I’m not as close to the how security works within EKS, but if you can associate a specific security group with individual workloads, then you can limit which traffic can reach the VPC endpoint ENIs on the Prometheus side
![shayyanmalik13 avatar](https://secure.gravatar.com/avatar/62d4833ac2d048f0f0e870f613db5bb7.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0010-72.png)
^^ Disregard - I believe I can expose prometheus pod as a service through NLB and use endpoint here.
![shayyanmalik13 avatar](https://secure.gravatar.com/avatar/62d4833ac2d048f0f0e870f613db5bb7.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0010-72.png)
Thank you so much @Joe Perez - privatelink’s the way to go.
![Joe Perez avatar](https://avatars.slack-edge.com/2022-11-09/4361990079457_b06c12666181bb7ec599_72.jpg)
No problem. I also wrote a couple of articles on what I’ve learned about PrivateLink
![Joe Perez avatar](https://avatars.slack-edge.com/2022-11-09/4361990079457_b06c12666181bb7ec599_72.jpg)
Overview Your company is growing and now you have to find out how to allow communication between services across VPCs and AWS accounts. You don’t want send traffic over the public Internet and maintaining VPC Peering isn’t a fun prospect. Implementing an AWS supported solution is the top priority and AWS PrivateLink can be a front-runner for enabling your infrastructure to scale. Lesson What is AWS PrivateLink? PrivateLink Components Gotchas Next Steps What is AWS PrivateLink?
![Joe Perez avatar](https://avatars.slack-edge.com/2022-11-09/4361990079457_b06c12666181bb7ec599_72.jpg)
Overview In the previous PrivateLink post, we went through the separate resources that make up AWS PrivateLink. In this post, we will be provisioning a PrivateLink configuration which will allow resources in one VPC to connect to a web service in another VPC. You can use several different AWS services to accomplish the same goal, but PrivateLink can simplify some setups and meet security expectations with its standard one-way communication.
![shayyanmalik13 avatar](https://secure.gravatar.com/avatar/62d4833ac2d048f0f0e870f613db5bb7.jpg?s=72&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0010-72.png)