View a markdown version of this page

AWS PrivateLink for Amazon Chime SDK - Amazon Chime SDK
ConsiderationsCreating an interface endpointPrivate DNSCreating a VPC endpoint policy

AWS PrivateLink for Amazon Chime SDK

With AWS PrivateLink, you can create interface virtual private cloud (VPC) endpoints to access Amazon Chime SDK Voice, Amazon Chime SDK Meetings, Amazon Chime SDK Messaging, Amazon Chime SDK Identity, and Amazon Chime SDK Media Pipelines APIs directly from your VPC. When you use an interface endpoint, traffic between your VPC and these services stays within the AWS network and doesn't traverse the public internet.

Interface endpoints are powered by AWS PrivateLink, which enables private connectivity to Amazon Chime SDK APIs using private IP addresses. You don't need an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. For more information about AWS PrivateLink, see the AWS PrivateLink Guide.

Considerations

  • Interface endpoints route API requests only. The following types of traffic do not support PrivateLink:

    • PSTN audio and media streams (Amazon Chime SDK Voice)

    • SIP signaling and media for Voice Connectors (Amazon Chime SDK Voice)

    • Meeting media, including audio and video (Amazon Chime SDK Meetings)

    • WebSocket connections for real-time messaging (Amazon Chime SDK Messaging)

    • Meeting media capture and live streaming (Amazon Chime SDK Media Pipelines)

  • SIP traffic to and from Voice Connectors uses direct IP connectivity and does not traverse interface endpoints.

  • When you use an interface endpoint, all API calls from your VPC go through the endpoint. This applies to calls made with an AWS SDK or the AWS CLI, such as calls to create voice connectors, start meetings, send messages, or manage media pipelines.

  • Interface endpoints support both IPv4 and IPv6 (dualstack) traffic.

  • Interface endpoints support VPC endpoint policies. You can use endpoint policies to control which principals can use the endpoint and which API actions they can perform.

  • FIPS endpoints through PrivateLink are available in the following Regions:

    Region Voice Meetings Messaging Identity Media Pipelines
    US East (N. Virginia) Yes Yes Yes Yes Yes
    US West (Oregon) Yes Yes Yes
    Canada (Central) Yes Yes Yes
    AWS GovCloud (US-East) Yes
    AWS GovCloud (US-West) Yes

  • In AWS GovCloud (US) Regions, interface endpoints use FIPS by default, and IAM policies use the aws-us-gov partition.

Creating an interface endpoint

You can create an interface endpoint for Amazon Chime SDK services using the Amazon VPC console or the AWS Command Line Interface. For more information about creating endpoints, see Create a VPC endpoint in the AWS PrivateLink Guide.

Create an interface endpoint using one of the following service names:

com.amazonaws.region.chime-sdk-voice
com.amazonaws.region.meetings-chime
com.amazonaws.region.messaging-chime
com.amazonaws.region.identity-chime
com.amazonaws.region.media-pipelines-chime

The following example uses the AWS CLI to create an interface endpoint for Amazon Chime SDK Meetings. To create an endpoint for a different service, replace the service name accordingly (for example, com.amazonaws.us-east-1.chime-sdk-voice for Voice).

aws ec2 create-vpc-endpoint \
    --vpc-id vpc-1a2b3c4d \
    --vpc-endpoint-type Interface \
    --service-name com.amazonaws.us-east-1.meetings-chime \
    --subnet-ids subnet-abababab \
    --security-group-ids sg-1a2b3c4d

Private DNS

When you create an interface endpoint with private DNS enabled, you can make API requests to Amazon Chime SDK services using the following endpoint DNS names:

Amazon Chime SDK Voice

  • voice-chime.region.amazonaws.com

  • voice-chime.region.api.aws

Amazon Chime SDK Meetings

  • meetings-chime.region.amazonaws.com

  • meetings-chime.region.api.aws

Amazon Chime SDK Messaging

  • messaging-chime.region.amazonaws.com

  • messaging-chime.region.api.aws

Amazon Chime SDK Identity

  • identity-chime.region.amazonaws.com

  • identity-chime.region.api.aws

Amazon Chime SDK Media Pipelines

  • media-pipelines-chime.region.amazonaws.com

  • media-pipelines-chime.region.api.aws

With private DNS enabled, you don't need to make any changes to your application code or SDK configuration. Requests to the standard Amazon Chime SDK endpoints automatically route through the interface endpoint.

For more information about private DNS, see Private DNS in the AWS PrivateLink Guide.

FIPS endpoints

Amazon Chime SDK Voice FIPS endpoints are available in US East (N. Virginia), US West (Oregon), and Canada (Central):

  • voice-chime-fips.region.amazonaws.com

  • voice-chime-fips.region.api.aws

Amazon Chime SDK Meetings FIPS endpoints are available in US East (N. Virginia), US West (Oregon), Canada (Central), AWS GovCloud (US-East), and AWS GovCloud (US-West):

  • meetings-chime-fips.region.amazonaws.com

  • meetings-chime-fips.region.api.aws

Amazon Chime SDK Messaging FIPS endpoints are available in US East (N. Virginia):

  • messaging-chime-fips.region.amazonaws.com

  • messaging-chime-fips.region.api.aws

Amazon Chime SDK Identity FIPS endpoints are available in US East (N. Virginia):

  • identity-chime-fips.region.amazonaws.com

  • identity-chime-fips.region.api.aws

Amazon Chime SDK Media Pipelines FIPS endpoints are available in US East (N. Virginia), US West (Oregon), and Canada (Central):

  • media-pipelines-chime-fips.region.amazonaws.com

  • media-pipelines-chime-fips.region.api.aws

Creating a VPC endpoint policy

You can attach a VPC endpoint policy to control access to Amazon Chime SDK APIs through the endpoint. The policy specifies the following:

  • The principals that can perform actions

  • The actions that can be performed

  • The resources on which actions can be performed

For more information about endpoint policies, see VPC endpoint policies in the AWS PrivateLink Guide.

Example Restrict endpoint to specific actions

The following endpoint policy allows all principals to call GetVoiceConnector and ListVoiceConnectors (Voice), CreateMeeting and GetMeeting (Meetings), and CreateMediaCapturePipeline and ListMediaPipelines (Media Pipelines) through the endpoint, but denies all other actions.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "chime:GetVoiceConnector",
                "chime:ListVoiceConnectors",
                "chime:CreateMeeting",
                "chime:GetMeeting",
                "chime:CreateMediaCapturePipeline",
                "chime:ListMediaPipelines"
            ],
            "Resource": "*"
        }
    ]
}
Example Restrict access to a specific VPC endpoint

The following IAM policy denies access to Amazon Chime SDK APIs unless the request originates from a specific VPC endpoint. Use the aws:sourceVpce condition key to restrict access.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "chime:*",
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:sourceVpce": "vpce-1a2b3c4d"
                }
            }
        }
    ]
}