Private alias endpoints for isolated virtual networks
In accordance with a designation of a private alias endpoint as a routing target for traffic directed to a service from within an isolated virtual network of a provider network, a tunneling intermediary receives a baseline packet generated at a compute instance. The baseline packet indicates a public IP (Internet Protocol) address of the service as the destination, and a private IP address of the compute instance as the source. In accordance with a tunneling protocol, the tunneling intermediary generates an encapsulation packet comprising at least a portion of the baseline packet and a header indicating the isolated virtual network. The encapsulation packet is transmitted to a node of the service.
1. A system, comprising:
one or more processors; and
a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to:
receive, from a client, a request to create a first private alias endpoint (PAE) as a routing target for traffic originating from an isolated virtual network (IVN) established at a provider network in accordance with an application programming interface (API), wherein the traffic is to be directed to a publicly-accessible service implemented in the provider network; and
configure, responsive to the request, a tunneling intermediary to:
generate a route table indicating that packets directed from the IVN to a public address of the publicly-accessible service are to be directed to the PAE; and
generate, in accordance with the route table, an encapsulation packet comprising a baseline packet, wherein the baseline packet is directed from the IVN to a public address of the publicly-accessible service; and
transmit the encapsulation packet, from the tunneling intermediary to the publicly-accessible service, without traversing network links outside the provider network.
2. The system of claim 1 , wherein the instructions further cause the one or more processors to:
receive, from the client, a request to assign the publicly-accessible service to the PAE;
update configuration metadata for the PAE; and
send, to the client, an acknowledgement indicating that the publicly-accessible service is assigned to the PAE.
3. The system of claim 1 , further comprising a second tunneling intermediary configured to:
receive the encapsulation packet;
generate, in accordance with a tunneling protocol, a second encapsulation packet based at least in part on the encapsulation packet, wherein the second encapsulation packet indicates the IVN as a source IVN; and
transmit the second encapsulation packet to a node of the publicly-accessible service.
4. The system of claim 3 , wherein the baseline packet is formatted in accordance with IPv4 (version 4 of the Internet Protocol), and wherein the second encapsulation packet is formatted in accordance with IPv6 (version 6 of the Internet Protocol).
5. The system of claim 1 , wherein the IVN comprises a first compute instance having a private IP address, and wherein the instructions further cause the one or more processors to:
establish a second IVN on behalf of the client, wherein the second IVN includes a second compute instance;
assign, responsive to a request of the client, the private IP address of the first compute instance to the second compute instance; and
establish a second PAE to be used for routing traffic originating from the second IVN and directed to the publicly-accessible service.
6. The system of claim 1 , wherein the instructions further cause the one or more processors to:
generate a user interface to receive the request to create the PAE; and
transmit the user interface to the client via a public network.
7. The system of claim 1 , wherein the encapsulation packet is formatted in accordance with a proprietary tunneling protocol implemented at the provider network.
8. A method, comprising:
receiving, from a client, a request to create a private endpoint (PE) as a routing target for traffic originating from for an isolated virtual network (IVN) established at a provider network in accordance with a request to an application programming interface (API), wherein the traffic is to be delivered to a publicly-accessible service implemented in the provider network; and
configuring, responsive to the request, a tunneling intermediary to perform:
generating route information indicating that packets directed from the IVN to a public address of the publicly-accessible service are to be directed to the PE;
generating an encapsulation packet comprising a baseline packet in accordance with the route information, wherein the baseline packet is directed from the IVN to the public address of the publicly-accessible service; and
transmitting the encapsulation packet, from the tunneling intermediary to the publicly-accessible service, without traversing network links outside the provider network.
9. The method of claim 8 , further comprising:
receiving, from the client, a request to assign the publicly-accessible service to the PE;
updating configuration metadata for the PE; and
sending, to the client, an acknowledgement indicating that the publicly-accessible service is assigned to the PE.
10. The method of claim 8 , further comprising:
generating a user interface to receive the request to create the PE; and
transmitting the user interface to the client via a public network.
11. The method of claim 8 , wherein generating the encapsulation packet comprises:
retrieving an indication of the PE from the route information based at least in part on the public address indicated in the baseline packet.
12. The method of claim 8 , further comprising:
receiving, via a programmatic interface, a request to register a different service for access using another PE; and
adding the different service to a collection of services from which a particular service can be selected by the client for association with a particular PE.
13. The method of claim 8 , wherein generating the route information further comprises:
assigning an alias for the publicly-accessible service; and
indicating a private address for the PE as the routing target.
14. The method of claim 8 , wherein the encapsulation packet is formatted in accordance with a proprietary tunneling protocol implemented at the provider network.
15. One or more non-transitory, computer-readable storage media storing instructions that, when executed on or across one or more processors, cause one or more computer systems to:
receive, from a client, a request to create a private alias endpoint (PAE) as a routing target for traffic originating from for an isolated virtual network (IVN) established at a provider network in accordance with an application programming interface (API), wherein the traffic is to be delivered to a publicly-accessible service implemented in the provider network;
configure a tunneling intermediary to:
generate a route table indicating that packets directed from the IVN to a public address of the publicly-accessible service are to be directed to the PAE;
generate an encapsulation packet comprising a baseline packet in accordance with the route table, wherein the baseline packet is directed from the IVN to the public address of the publicly-accessible service; and
transmit the encapsulation packet, from the tunneling intermediary to the publicly-accessible service, without traversing network links outside the provider network.
16. The one or more non-transitory, computer-readable storage media of claim 15 , wherein the instructions further cause the one or more computer systems to:
receive, from the client, a request to assign the publicly-accessible service to the PAE;
update configuration metadata for the PAE; and
send, to the client, an acknowledgement indicating that the publicly-accessible service is assigned to the PAE.
17. The one or more non-transitory, computer-readable storage media of claim 15 , wherein the instructions further cause the one or more computer systems to:
generate a user interface to receive the request to create the PAE; and
transmit the user interface to the client via a public network.
18. The one or more non-transitory, computer-readable storage media of claim 15 , wherein the user interface comprises a list of registered service names that are selectable for associating with the PAE.
19. The one or more non-transitory, computer-readable storage media of claim 15 , wherein to generate the encapsulation packet, the tunneling intermediary is further configured to:
retrieve an indication of the PAE from the route table based at least in part on the public address indicated in the baseline packet.
20. The one or more non-transitory, computer-readable storage media of claim 15 , wherein the encapsulation packet is formatted in accordance with a proprietary tunneling protocol implemented at the provider network.