Private Service Endpoints across clouds
Reaching a service over the provider network rather than the internet - PrivateLink, Private Endpoint, Private Service Connect - so a database or an API has an address inside your network and none outside.
3 verified modules, 1 of them live-tested apply→verify→destroy; the rest are static-validated, live-test pending.
Compare by provider
| Provider | Module | Verification |
|---|---|---|
| AWS | The Provider Side of PrivateLink, Not Open to Everyone | static-validated |
| Azure | Azure Private Endpoint (Private Link) | ✓ live-tested |
| Google Cloud | A Published Service that Decides Who May Connect | static-validated |
How to choose
Compare which side you are on: publishing a service to consumers (an endpoint service) or consuming one (an endpoint). Then DNS, which is where these fail: the private address is useless until the service name resolves to it inside the network, and each cloud does that differently.
When not to use
A private endpoint removes the public path only when the public path is also closed. The service must still refuse public access itself; the endpoint is a second door, not a lock on the first.