4 ms·

I presume that given they mention that it only supports public endpoints, that it's just a directly peered connection on the public internet and there's no spec

I presume that given they mention that it only supports public endpoints, that it's just a directly peered connection on the public internet and there's no special security stuff at play here?

donavanm 2y ago
Kind of. Im pretty sure “public endpoint” is to disambiguate from virtual network functionality like VPC Endpoints and VPC Peering etc which are specific to your account/VPC. To your other comment, not many companies own the “layer 0” physical infra long haul. But yes, this is almost absolutely going over “dark fiber” that AWS is leasing from someone like zayo or L3. Since 2016ish effectively all AWS regions and DX POPs use this model to interconnect. The LAX & NYC sites are almost definitely the same DCs & TCs used for “local zones.” So yes, a few hundred gb to tb of leased lines back to PDX and IAD. Search for “aws backbone” content. And for security Im not sure whats public these days, but fiber taps are a real and known threat. Source: ex AWS PE who spent some time in and adjacent to edge networking.
vineyardmike 2y ago
They probably mentioned public endpoints to highlight that they allow access to AWS services but they’re not renting out access to a massive bandwidth pipe for non-customers or to upload to non-AWS. The “public endpoints” part probably is used to warn customers that existing technical limitations apply wrt abilities- eg you can’t dump data directly to the S3 data plane, you still have to go through the public API. Considering the fiber connection is “part of the AWS network”, it may not have access to the outside internet, but also contextually probably doesn’t have any privileged access to AWS servers.
- unsnap_biceps 2y ago
  My statement that it's on the public internet is more that it's directly connected to someone like level3 and not a direct fiber drop to an AWS datacenter. I would be surprised if the building in NYC has direct fiber to IAD or if the building in LA has direct fiber to SFO.

I presume that given they mention that it only supports public endpoints, that it's just a directly peered connection on the public internet and there's no special security stuff at play here?

donavanm 2y ago

Kind of. Im pretty sure “public endpoint” is to disambiguate from virtual network functionality like VPC Endpoints and VPC Peering etc which are specific to your account/VPC. To your other comment, not many companies own the “layer 0” physical infra long haul. But yes, this is almost absolutely going over “dark fiber” that AWS is leasing from someone like zayo or L3. Since 2016ish effectively all AWS regions and DX POPs use this model to interconnect. The LAX & NYC sites are almost definitely the same DCs & TCs used for “local zones.” So yes, a few hundred gb to tb of leased lines back to PDX and IAD. Search for “aws backbone” content. And for security Im not sure whats public these days, but fiber taps are a real and known threat. Source: ex AWS PE who spent some time in and adjacent to edge networking.

vineyardmike 2y ago

They probably mentioned public endpoints to highlight that they allow access to AWS services but they’re not renting out access to a massive bandwidth pipe for non-customers or to upload to non-AWS. The “public endpoints” part probably is used to warn customers that existing technical limitations apply wrt abilities- eg you can’t dump data directly to the S3 data plane, you still have to go through the public API. Considering the fiber connection is “part of the AWS network”, it may not have access to the outside internet, but also contextually probably doesn’t have any privileged access to AWS servers.

unsnap_biceps 2y ago
My statement that it's on the public internet is more that it's directly connected to someone like level3 and not a direct fiber drop to an AWS datacenter. I would be surprised if the building in NYC has direct fiber to IAD or if the building in LA has direct fiber to SFO.