I have VPC with couple of subnets containing EC2 instances.

The EC2 instances have code that invokes various AWS services like dybamodb.

Is the connection from EC2 to AWS Service (like dynamodb) happening within the AWS Network, or via public internet?

Is there any way to control this?

CodePudding user response：

Is the connection from EC2 to AWS Service (like dynamodb) happening within the AWS Network, or via public internet?

Technically the process on EC2 would be hitting the AWS DynamoDB public API which is on the Internet. The traffic would be routed through the Internet Gateway you have attached to the VPC. I think if it is all in the same region it may not actually leave the AWS data center, and you could try testing that via tools like traceroute, but I don't think there are any guarantees of that.

Is there any way to control this?

Yes, add a VPC Endpoint to your VPC for the service you want to connect to. Then the DNS server in your VPC will route all traffic to that service over the VPC Endpoint, instead of routing it to your VPC's Internet Gateway. The traffic will then be guaranteed to stay within the AWS network.