Private Service Endpoints across clouds
Reaching a service over the provider network rather than the internet - PrivateLink, Private Endpoint, Private Service Connect - so a database or an API has an address inside your network and none outside.
7 verified modules, 1 of them live-tested apply→verify→destroy; the rest are static-validated, live-test pending.
Compare by provider
| Provider | Module | Verification |
|---|---|---|
| Alibaba Cloud | A PrivateLink Endpoint with an Interface per Zone Behind Your Security Groups, Protected from Deletion | static-validated |
| AWS | The Provider Side of PrivateLink, Not Open to Everyone | static-validated |
| Azure | Azure Private Endpoint (Private Link) | ✓ live-tested |
| Google Cloud | A Published Service that Decides Who May Connect | static-validated |
| Huawei Cloud | A VPC Endpoint Whitelisted to the CIDRs You Name, with Private DNS | static-validated |
| IBM Cloud | A Virtual Private Endpoint Gateway with a Reserved IP per Zone Behind Your Security Groups | static-validated |
| Tencent Cloud | A Private Link Endpoint with a VIP in Your Subnet Behind Your Security Groups | static-validated |
How to choose
Compare which side you are on: publishing a service to consumers (an endpoint service) or consuming one (an endpoint). Then DNS, which is where these fail: the private address is useless until the service name resolves to it inside the network, and each cloud does that differently.
When not to use
A private endpoint removes the public path only when the public path is also closed. The service must still refuse public access itself; the endpoint is a second door, not a lock on the first.