---
title: "Reach managed services over private · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/private-endpoints
id: INF-87
level: Recommended
applies: servers
updated: 2026-10-27
build: a2a6bdfed830
tokens: 907
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Reach managed services over private endpoints

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: INF-87
- Level: Recommended
- Chapter: [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns.md)
- Rule: Connect servers to managed databases, storage and secret stores over private endpoints inside your network. Turn off the public address of each managed data service.
- Check: A script lists every managed database, bucket and secret store in production. Each has public network access turned off, and a connection from outside the network fails. The app still reaches each one through its endpoint.
- Applies when: The project runs its own servers, virtual machines or containers.
- How: Many managed services answer on a public address by default, guarded only by a password or a key. A private endpoint gives the service an address inside your network, such as AWS PrivateLink, Azure Private Link or Google Private Service Connect. Then turn off public access on the service itself, and limit the storage or key policy to calls that come through the endpoint. Servers then need no route to the internet to reach their data, which also helps [Limit where servers can send traffic](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/egress-control.md). Databases themselves sit in private subnets, as [Keep databases in private subnets](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/private-data-stores.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Terraform example

```hcl
resource "aws_vpc_endpoint" "s3" {
  vpc_id          = aws_vpc.main.id
  service_name    = "com.amazonaws.eu-north-1.s3"
  route_table_ids = [aws_route_table.private.id]
}

resource "azurerm_postgresql_flexible_server" "orders" {
  name                          = "orders"
  public_network_access_enabled = false
  # other settings left out
}
```

## Sources

- [What is AWS PrivateLink?](https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html)
- [Azure Private Link overview](https://learn.microsoft.com/en-us/azure/private-link/private-link-overview)

## Related rules

- INF-32 [Limit where servers can send traffic](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/egress-control.md) in Infrastructure and environments
- INF-29 [Keep databases in private subnets](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/private-data-stores.md) in Infrastructure and environments

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/networking-and-dns/private-endpoints">Agent Wranglers infrastructure and environments playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Put a web application firewall and flood protection in front of public services](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/waf-and-ddos.md)
- [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns.md)