I tried implementing a configuration that connects using a private DNS name with AWS PrivateLink in AWS CDK

			
			import * as cdk from "aws-cdk-lib";
import * as acm from "aws-cdk-lib/aws-certificatemanager";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as elbv2 from "aws-cdk-lib/aws-elasticloadbalancingv2";
import * as elbv2_targets from "aws-cdk-lib/aws-elasticloadbalancingv2-targets";
import * as iam from "aws-cdk-lib/aws-iam";
import * as route53 from "aws-cdk-lib/aws-route53";
import { Construct } from "constructs";

const CONSUMER_ACCOUNT_ID = process.env.CONSUMER_ACCOUNT_ID;
const CUSTOM_DOMAIN_NAME = process.env.CUSTOM_DOMAIN_NAME || "";

export class PrivateLinkProviderConstruct extends Construct {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    /**
     * Creating a VPC
     */
    const vpc = new ec2.Vpc(this, "VPC", {
      subnetConfiguration: [
        // Only creating private subnets assuming connections to ALB are allowed only via PrivateLink
        {
          name: "PrivateIsolated",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        },
      ],
      maxAzs: 2, // Specifying minimum configuration for testing. ALB requires 2 AZs
      natGateways: 0, // Setting NAT Gateway to 0 as it's not used in this test
      restrictDefaultSecurityGroup: true, // Restricting default security group to minimize access permissions
    });

    // -----------------------------------------------
    // ↓ DNS and SSL certificate configuration
    // -----------------------------------------------

    /**
     * Referencing existing Route 53 hosted zone
     */
    const hostedZone = route53.HostedZone.fromLookup(this, "HostedZone", {
      domainName: CUSTOM_DOMAIN_NAME,
    });

    /**
     * PrivateLink subdomain configuration
     */
    const privateLinkDomainName = `privatelink.${CUSTOM_DOMAIN_NAME}`;

    /**
     * Creating SSL certificate (ACM)
     */
    const certificate = new acm.Certificate(this, "Certificate", {
      domainName: privateLinkDomainName,
      subjectAlternativeNames: [`*.${privateLinkDomainName}`],
      validation: acm.CertificateValidation.fromDns(hostedZone),
    });

    // -----------------------------------------------
    // ↓ Implementation of the service to be exposed (ALB)
    // -----------------------------------------------

    /**
     * Creating ALB
     */
    const alb = new elbv2.ApplicationLoadBalancer(
      this,
      "ApplicationLoadBalancer",
      {
        vpc,
        vpcSubnets: {
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        },
      }
    );

    /**
     * Creating ALB listener
     */
    alb.addListener("AlbListener", {
      port: 443,
      defaultAction: elbv2.ListenerAction.fixedResponse(200, {
        messageBody: "Hello from ALB!",
      }),
      certificates: [certificate],
    });

    // -----------------------------------------------
    // ↓ Implementation required for the PrivateLink provider side
    // -----------------------------------------------

    /**
     * Creating NLB
     */
    const nlb = new elbv2.NetworkLoadBalancer(this, "NetworkLoadBalancer", {
      vpc,
      internetFacing: false,
      vpcSubnets: {
        subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
      },
    });

    /**
     * Creating target group for NLB
     */
    const nlbTargetGroup = new elbv2.NetworkTargetGroup(
      this,
      "NlbTargetGroup",
      {
        port: 443,
        vpc,
      }
    );

    /**
     * Adding ALB as a target for NLB
     */
    nlbTargetGroup.addTarget(
      new elbv2_targets.AlbListenerTarget(alb.listeners[0])
    );

    /**
     * Creating NLB listener
     */
    nlb.addListener("NlbListener", {
      port: 443,
      defaultTargetGroups: [nlbTargetGroup],
    });

    /**
     * Creating VPC Endpoint Service (PrivateLink provider)
     */
    const vpcEndpointService = new ec2.VpcEndpointService(
      this,
      "VpcEndpointService",
      {
        vpcEndpointServiceLoadBalancers: [nlb],
        acceptanceRequired: true, // Setting manual approval as required
        allowedPrincipals: [
          new iam.ArnPrincipal(`arn:aws:iam::${CONSUMER_ACCOUNT_ID}:root`),
        ],
      }
    );

    /**
     * Outputting the VPC endpoint service name
     */
    new cdk.CfnOutput(this, "ProviderVpcEndpointServiceName", {
      value: vpcEndpointService.vpcEndpointServiceName,
    });
  }
}
```In the above setup, we configure a subdomain `privatelink.<custom domain>` for PrivateLink and create an SSL certificate in ACM. We also create a listener using HTTPS (port 443) with this certificate.

Deploy the CDK with environment variables `CONSUMER_ACCOUNT_ID` set to the consumer's AWS account ID and `CUSTOM_DOMAIN_NAME` set to your custom domain.

### Provider Side (Setting up Private DNS Name)

Open the VPC endpoint service details screen created by the deployment and click **Change private DNS name**.
![](https://devio2024-2-media.developers.io/upload/wp-author-wakatsuki-ryuta/2025-08-31/Y8992zoHOty4.png)

Check **Associate private DNS name with service**, specify the private DNS name to use, and save.
![](https://devio2024-2-media.developers.io/upload/wp-author-wakatsuki-ryuta/2025-08-31/cTkcTtFiTtJc.png)

Back on the details screen, the domain verification status will show `Pending verification`, and domain verification name and value will be displayed.
![](https://devio2024-2-media.developers.io/upload/wp-author-wakatsuki-ryuta/2025-08-31/21rmR7quoBIB.png)

Add the domain verification name and value as a TXT record to your Route 53 hosted zone. According to the documentation, the TTL value should be set to `1800`.
![](https://devio2024-2-media.developers.io/upload/wp-author-wakatsuki-ryuta/2025-08-31/oHfZa6q6dzrC.png)

Return to the VPC endpoint service details screen and click **Verify domain ownership for private DNS name**.
![](https://devio2024-2-media.developers.io/upload/wp-author-wakatsuki-ryuta/2025-08-31/IEcHEF15updy.png =400x)

Verify ownership. (It's unclear why entering "verification" is required here)
![](https://devio2024-2-media.developers.io/upload/wp-author-wakatsuki-ryuta/2025-08-31/8l8yYt5mAbXj.png =600x)

The process may take some time, but once domain verification is complete, the status will change to `Verified`.
![](https://devio2024-2-media.developers.io/upload/wp-author-wakatsuki-ryuta/2025-08-31/Ta2YfDQLFLRM.png)

The private DNS name setup is now complete. You can delete the TXT record you registered earlier.

Share the VPC endpoint service name (`com.amazonaws.vpce.ap-northeast-1.<endpoint service ID>`) and the private DNS name (`privatelink.<custom domain name>`) with the consumer.### Consumer side (creating VPC endpoint)

Once the consumer side receives the VPC endpoint service name and private DNS name from the provider side, implement it with AWS CDK as follows:

```ts:lib/constructs/privatelink-consumer.ts
import * as cdk from "aws-cdk-lib";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as logs from "aws-cdk-lib/aws-logs";
import * as lambda_nodejs from "aws-cdk-lib/aws-lambda-nodejs";
import { Construct } from "constructs";

const PROVIDER_VPC_ENDPOINT_SERVICE_NAME =
  process.env.PROVIDER_VPC_ENDPOINT_SERVICE_NAME || "";
const PRIVATE_DNS_NAME = process.env.PRIVATE_DNS_NAME || "";

export class PrivateLinkConsumerConstruct extends Construct {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    /**
     * Creating a VPC
     */
    const vpc = new ec2.Vpc(this, "VPC", {
      subnetConfiguration: [
        // Creating only private subnets, assuming communications will only go through VPC endpoints
        {
          name: "PrivateIsolated",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        },
      ],
      maxAzs: 1, // Limiting to 1 AZ for testing purposes
      natGateways: 0, // Not using NAT Gateway for testing purposes
      restrictDefaultSecurityGroup: true, // Restricting default security group to minimize access permissions
    });

    // -----------------------------------------------
    // ↓ Implementation needed for PrivateLink consumer side
    // -----------------------------------------------

    /**
     * Security Group for VPC Endpoint
     *
     * MEMO: Explicitly created to restrict connections to VPC Endpoint only. (If not explicitly created, allowAllOutbound is enabled by default)
     */
    const vpcEndpointSecurityGroup = new ec2.SecurityGroup(
      this,
      "VpcEndpointSecurityGroup",
      {
        vpc,
        allowAllOutbound: false,
      }
    );

    /**
     * Creating a VPC Endpoint
     */
    const vpcEndpoint = new ec2.InterfaceVpcEndpoint(
      this,
      "PrivateLinkEndpoint",
      {
        vpc,
        service: new ec2.InterfaceVpcEndpointService(
          PROVIDER_VPC_ENDPOINT_SERVICE_NAME
        ),
        subnets: {
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        },
        securityGroups: [vpcEndpointSecurityGroup],
        open: false, // Disabling the setting that allows all traffic from within the VPC to this endpoint by default
        /**
         * Enable this if the provider has set a private DNS name for the VPC endpoint service
         * @see https://docs.aws.amazon.com/ja_jp/vpc/latest/privatelink/manage-dns-names.html
         */
        // privateDnsEnabled: true, // Enable this after the provider accepts
      }
    );

    // -----------------------------------------------
    // ↓ Implementation of resources (Lambda) to access the provider side
    // -----------------------------------------------

    /**
     * Security Group for Lambda
     *
     * MEMO: Explicitly created to restrict connections to VPC Endpoint only. (If not explicitly created, allowAllOutbound is enabled by default)
     */
    const lambdaSecurityGroup = new ec2.SecurityGroup(
      this,
      "LambdaSecurityGroup",
      {
        vpc,
        allowAllOutbound: false,
      }
    );

    /**
     * Lambda function for testing PrivateLink connection
     */
    new lambda_nodejs.NodejsFunction(this, "PrivateLinkTestLambda", {
      entry: "handler.ts",
      logGroup: new logs.LogGroup(this, "LogGroup", {
        removalPolicy: cdk.RemovalPolicy.DESTROY, // Since this is a test resource, delete the log group when the stack is deleted
      }),
      vpc,
      vpcSubnets: {
        subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
      },
      securityGroups: [lambdaSecurityGroup],
      environment: {
        // Set the DNS name to access the VPC endpoint from the Lambda function as an environment variable
        VPC_ENDPOINT_DNS_NAME: `https://${PRIVATE_DNS_NAME}`,
      },
    });

    /**
     * Allow access from lambdaFunction to VPC Endpoint on port 443
     */
    vpcEndpoint.connections.allowFrom(lambdaSecurityGroup, ec2.Port.tcp(443));
  }
}
```:::details Connectivity Verification Lambda Function Handler Implementation

```ts:handler.ts
import axios from "axios";

const VPC_ENDPOINT_DNS_NAME = process.env.VPC_ENDPOINT_DNS_NAME || "";

export const handler = async () => {
  console.log(VPC_ENDPOINT_DNS_NAME);
  try {
    const response = await axios.get(VPC_ENDPOINT_DNS_NAME);
    console.log("Response:", response.data);
    return response.data;
  } catch (error) {
    console.error("Error:", error);
    return { error: "Failed to fetch data" };
  }
};