# Amazon PrivateLink for Amazon MWAA
<a name="security-privatelink"></a>

With Amazon PrivateLink, you can access Amazon MWAA from within your VPC without crossing the public internet. Interface VPC endpoints are elastic network interfaces with private IP addresses in your subnets. For more information, see [Access an Amazon service using an interface VPC endpoint](https://docs.amazonaws.cn/vpc/latest/privatelink/create-interface-endpoint.html) in the *Amazon VPC User Guide*.

## Creating a VPC endpoint
<a name="security-privatelink-create"></a>

Amazon MWAA uses prefixes for service endpoints, where each prefix corresponds to a set of API operations:

Environment management  
`api.airflow.{{region}}.amazonaws.com` (use `api.airflow.{{region}}.api.aws` for IPv6)  
+ `CreateEnvironment`
+ `DeleteEnvironment`
+ `GetEnvironment`
+ `ListEnvironments`
+ `ListTagsForResource`
+ `TagResource`
+ `UntagResource`
+ `UpdateEnvironment`

Airflow environment  
`env.airflow.{{region}}.amazonaws.com` (use `env.airflow.{{region}}.api.aws` for IPv6)  
+ `CreateCliToken`
+ `CreateWebLoginToken`

## FIPS endpoints
<a name="security-privatelink-fips"></a>

FIPS-compliant endpoints are available in US and Canada Regions:
+ `com.amazonaws.{{region}}.airflow-fips.api`
+ `com.amazonaws.{{region}}.airflow-fips.env`

For more information about supported Regions, see [Amazon MWAA endpoints and quotas](https://docs.amazonaws.cn/general/latest/gr/mwaa.html#mwaa_region) in the *Amazon General Reference*.