Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon Directory Service API and interface Amazon VPC endpoints using Amazon PrivateLink

You can use Amazon PrivateLink to create a private connection between your VPC and Amazon Directory Service APIs. You can access Amazon Directory Service APIs as if they were in your VPC, without the use of an internet gateway, NAT device, VPN connection, or Amazon Direct Connect connection. Instances in your VPC don't need public IP addresses to access Amazon Directory Service APIs.

You establish this private connection by creating an interface endpoint, powered by Amazon PrivateLink. We create an endpoint network interface in each subnet that you enable for the interface endpoint. These are requester-managed network interfaces that serve as the entry point for traffic destined for Amazon Directory Service.

For more information, see Access Amazon Web Services through Amazon PrivateLink in the Amazon PrivateLink Guide.

Considerations for Amazon Directory Service

Before you set up an interface endpoint for Amazon Directory Service API endpoints, review Considerations in the Amazon PrivateLink Guide.

Amazon Directory Service supports making calls to all of its API actions through the interface endpoint.

Availability

Amazon Directory Service supports VPC endpoints in the following Amazon Web Services Regions:

Create an interface endpoint for Amazon Directory Service

You can create an interface endpoint for Amazon Directory Service APIs using either the Amazon VPC console or the Amazon Command Line Interface (Amazon CLI). For more information, see Create an interface endpoint in the Amazon PrivateLink Guide.

Create an interface endpoint for Amazon Directory Service APIs using the following service name:

com.amazonaws.region.ds

Create an endpoint policy for your interface endpoint

An endpoint policy is an IAM resource that you can attach to an interface endpoint. The default endpoint policy allows full access to Amazon Directory Service APIs through the interface endpoint. To control the access allowed to Amazon Directory Service APIs from your VPC, attach a custom endpoint policy to the interface endpoint.

For more information, see Control access to services using endpoint policies in the Amazon PrivateLink Guide.

Example: VPC endpoint policy for Amazon Directory Service API actions

The following is an example of a custom endpoint policy. When you attach this policy to your interface endpoint, it grants access to the listed Amazon Directory Service actions for all principals on all resources. Replace action-1, action-2, and action-3 with the required permissions for the Amazon Directory Service APIs that you want to include in your policy. For a full list, see Amazon Directory Service API permissions: Actions, resources, and conditions reference.

{
   "Statement": [
      {
         "Principal": "*",
         "Effect": "Allow",
         "Action": [
            "ds:action-1",
            "ds:action-2",
            "ds:action-3"
         ],
         "Resource":"*"
      }
   ]
}