AWS PrivateLink Tunnel Endpoints

A dated reading of what is claimed, reported, and independently verified in the current evidence.

Current reading

Readiness band and full integer triple

AI-assisted assembly · derived results

Readiness band

Watch

Primary summary from verified readiness

Evidence strength Strong

Decision

Agent-assisted assessment · independently reviewed · 2026-10-04

Consider a controlled pilot for consumer-initiated TCP access to shared CIDR ranges if you can operate the required GENEVE relay.

Why: Published experiments demonstrate useful connectivity, including overlapping address ranges. Production performance, failover, and security assurance remain unestablished.
Next: Test your workloads, routing, least-privilege controls, and multi-AZ failure recovery before expanding into production.

Constraints

Consumer-side GENEVE relay operation adds deployment, routing, and availability responsibilities.
Application traffic is TCP-only; general UDP applications and QUIC are unsupported.
Connections must originate from the consumer; endpoint and gateway Availability Zones must overlap, and endpoint private DNS is unavailable.
Overlapping-IP host routes can shadow local destinations; transparent intermediary routing has additional subnet constraints.
Sustained performance, failover, and hardened production operation require workload-specific validation.
Sharing 0.0.0.0/0 with suitable egress routing can enable internet access from a nominally closed VPC.
Some API reference value lists omit Tunnel and CIDR; verify the tooling versions used for automation.

Evidence summary

AI-assisted assembly

Counts and dates only. Raw signals, private excerpts, trust records, and internal corpus material are not published here.

Publication record

Revision 5