VPCインターフェイスエンドポイントはAvailability Zoneによっては作成できない

VPCインターフェイスエンドポイントはAvailability Zoneによってはサポートされておらず、作成できません。東京リージョンでcom.amazonaws.ap-northeast-1.transferを作成しようとすると、apne1-az2では「このアベイラビリティーゾーンではサポートされていないサービスです」と表示されます。

AWS CLIでcom.amazonaws.ap-northeast-1.transferを作成できるAvailability Zoneを確認します。ap-northeast-1aとap-northeast-1cで作成できることがわかります。

$ aws ec2 describe-vpc-endpoint-services  --service-names com.amazonaws.ap-northeast-1.transfer
{
    "ServiceDetails": [
        {
            "ServiceName": "com.amazonaws.ap-northeast-1.transfer",
            "ServiceId": "vpce-svc-0084280811b9bda93",
            "ServiceType": [
                {
                    "ServiceType": "Interface"
                }
            ],
            "AvailabilityZones": [
                "ap-northeast-1a",
                "ap-northeast-1c"
            ],
（略）
}

執筆時点の東京リージョンでのAvailability Zoneの対応状況は以下の通りでした。ap-northeast-1dでは作成できないエンドポイントがいくつかあることがわかります。

$ aws ec2 describe-vpc-endpoint-services \
     --query 'sort_by(ServiceDetails,&ServiceName)[*].[ServiceName,join(`, `,AvailabilityZones)]' \
     --output table
----------------------------------------------------------------------------------------------------------------------
|                                             DescribeVpcEndpointServices                                            |
+--------------------------------------------------------------+-----------------------------------------------------+
|  aws.sagemaker.ap-northeast-1.notebook                       |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  aws.sagemaker.ap-northeast-1.studio                         |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.access-analyzer                |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.acm-pca                        |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.airflow.api                    |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.airflow.env                    |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.airflow.ops                    |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.application-autoscaling        |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.appmesh-envoy-management       |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.appstream.api                  |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.appstream.streaming            |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.athena                         |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.auditmanager                   |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.autoscaling                    |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.autoscaling-plans              |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.awsconnector                   |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.cassandra                      |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.cloudformation                 |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.cloudhsmv2                     |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.cloudtrail                     |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.codeartifact.api               |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.codeartifact.repositories      |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.codebuild                      |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.codecommit                     |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.codedeploy                     |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.codedeploy-commands-secure     |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.codeguru-profiler              |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.codeguru-reviewer              |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.codepipeline                   |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.codestar-connections.api       |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.comprehend                     |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.config                         |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.databrew                       |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.dataexchange                   |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.datasync                       |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.dms                            |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.dynamodb                       |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.ebs                            |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.ec2                            |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.ec2messages                    |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.ecr.api                        |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.ecr.dkr                        |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.ecs                            |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.ecs-agent                      |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.ecs-telemetry                  |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.elastic-inference.runtime      |  ap-northeast-1a, ap-northeast-1c                   |
|  com.amazonaws.ap-northeast-1.elasticbeanstalk               |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.elasticbeanstalk-health        |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.elasticfilesystem              |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.elasticfilesystem-fips         |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.elasticloadbalancing           |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.elasticmapreduce               |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.email-smtp                     |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.emr-containers                 |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.events                         |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.execute-api                    |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.git-codecommit                 |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.glue                           |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.imagebuilder                   |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.kinesis-firehose               |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.kinesis-streams                |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.kms                            |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.lambda                         |  ap-northeast-1a, ap-northeast-1c                   |
|  com.amazonaws.ap-northeast-1.license-manager                |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.logs                           |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.lookoutvision                  |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.macie2                         |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.monitoring                     |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.qldb.session                   |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.rds                            |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.rds-data                       |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.redshift                       |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.redshift-data                  |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.rekognition                    |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.s3                             |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.s3                             |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.sagemaker.api                  |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.sagemaker.featurestore-runtime |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.sagemaker.runtime              |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.secretsmanager                 |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.servicecatalog                 |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.sns                            |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.sqs                            |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.ssm                            |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.ssmmessages                    |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.states                         |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.storagegateway                 |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.sts                            |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.synthetics                     |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.transcribe                     |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.transcribestreaming            |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
|  com.amazonaws.ap-northeast-1.transfer                       |  ap-northeast-1a, ap-northeast-1c                   |
|  com.amazonaws.ap-northeast-1.transfer.server                |  ap-northeast-1a, ap-northeast-1c                   |
|  com.amazonaws.ap-northeast-1.workspaces                     |  ap-northeast-1a, ap-northeast-1c, ap-northeast-1d  |
+--------------------------------------------------------------+-----------------------------------------------------+
(END)

ap-northeast-1aや1c,1dのマッピングはAWSアカウントごとに異なります。私のアカウントのap-northeast-1aが他のAWSアカウントのap-northeast-1aと同じ場所ではないことがあります。AZ IDは全てのAWSアカウントで同じ場所を示します。私のアカウントのap-northeast-1dはAZ ID"apne1-az2"でした。

aws ec2 describe-availability-zones --query 'AvailabilityZones[].[ZoneName,ZoneId]' --output text
ap-northeast-1a apne1-az4
ap-northeast-1c apne1-az1
ap-northeast-1d apne1-az2
$

余談ですが、大阪リージョンのエンドポイントの対応状況をみると、東京リージョンと比較してVPCインターフェイスエンドポイントの対応数が少ないです。新しいリージョンですのでこれから対応するエンドポイントが増えていくと思います。

$ aws ec2 describe-vpc-endpoint-services \
>      --region ap-northeast-3 \
>      --query 'sort_by(ServiceDetails,&ServiceName)[*].[ServiceName,join(`, `,AvailabilityZones)]' \
>      --output table
------------------------------------------------------------------------------------------------------------------
|                                           DescribeVpcEndpointServices                                          |
+----------------------------------------------------------+-----------------------------------------------------+
|  com.amazonaws.ap-northeast-3.application-autoscaling    |  ap-northeast-3a                                    |
|  com.amazonaws.ap-northeast-3.autoscaling                |  ap-northeast-3a                                    |
|  com.amazonaws.ap-northeast-3.cloudformation             |  ap-northeast-3a                                    |
|  com.amazonaws.ap-northeast-3.cloudtrail                 |  ap-northeast-3a                                    |
|  com.amazonaws.ap-northeast-3.codedeploy-commands-secure |  ap-northeast-3a, ap-northeast-3b, ap-northeast-3c  |
|  com.amazonaws.ap-northeast-3.dms                        |  ap-northeast-3a, ap-northeast-3b, ap-northeast-3c  |
|  com.amazonaws.ap-northeast-3.dynamodb                   |  ap-northeast-3a, ap-northeast-3b, ap-northeast-3c  |
|  com.amazonaws.ap-northeast-3.ebs                        |  ap-northeast-3a, ap-northeast-3b                   |
|  com.amazonaws.ap-northeast-3.ec2messages                |  ap-northeast-3a                                    |
|  com.amazonaws.ap-northeast-3.elasticbeanstalk           |  ap-northeast-3a                                    |
|  com.amazonaws.ap-northeast-3.elasticbeanstalk-health    |  ap-northeast-3a                                    |
|  com.amazonaws.ap-northeast-3.elasticloadbalancing       |  ap-northeast-3a, ap-northeast-3b, ap-northeast-3c  |
|  com.amazonaws.ap-northeast-3.glue                       |  ap-northeast-3a, ap-northeast-3b, ap-northeast-3c  |
|  com.amazonaws.ap-northeast-3.kinesis-firehose           |  ap-northeast-3a, ap-northeast-3b, ap-northeast-3c  |
|  com.amazonaws.ap-northeast-3.kinesis-streams            |  ap-northeast-3a, ap-northeast-3b, ap-northeast-3c  |
|  com.amazonaws.ap-northeast-3.kms                        |  ap-northeast-3a, ap-northeast-3b, ap-northeast-3c  |
|  com.amazonaws.ap-northeast-3.logs                       |  ap-northeast-3a                                    |
|  com.amazonaws.ap-northeast-3.monitoring                 |  ap-northeast-3a, ap-northeast-3b, ap-northeast-3c  |
|  com.amazonaws.ap-northeast-3.s3                         |  ap-northeast-3a, ap-northeast-3b, ap-northeast-3c  |
|  com.amazonaws.ap-northeast-3.s3                         |  ap-northeast-3a, ap-northeast-3b, ap-northeast-3c  |
|  com.amazonaws.ap-northeast-3.secretsmanager             |  ap-northeast-3a, ap-northeast-3b                   |
|  com.amazonaws.ap-northeast-3.sqs                        |  ap-northeast-3a, ap-northeast-3b, ap-northeast-3c  |
|  com.amazonaws.ap-northeast-3.ssm                        |  ap-northeast-3a                                    |
|  com.amazonaws.ap-northeast-3.ssmmessages                |  ap-northeast-3a                                    |
|  com.amazonaws.ap-northeast-3.sts                        |  ap-northeast-3a                                    |
+----------------------------------------------------------+-----------------------------------------------------+

おわりに

VPCインターフェイスエンドポイントはAvailability Zoneによっては作成できないことを紹介しました。オンプレミスからDirect Connectを使ってAWSサービスに接続するケースやプライベートサブネットからエンドポイントに接続するケースでは、どのAvailability Zoneを使うのか考えたほうが良いと思います。

参考

• アベイラビリティーゾーン毎に使用できるVPCエンドポイントを調べてみた
• AZ IDs for your AWS resources