Vercel AWS PrivateLink, explained: what Pro teams get
Vercel now gives Pro and Enterprise teams a private route to AWS services. Here is the setup, pricing, limits, and decision rule.
On September 1, 2026, Vercel made AWS PrivateLink available to Pro and Enterprise teams through Advanced Networking. It gives your Vercel Functions and builds a private route to supported AWS services, so that traffic doesn't need to cross the public internet.
What Vercel PrivateLink actually is
PrivateLink changes the road between your Vercel project and a backend. It doesn't move the backend, replace its login, or give Vercel a dedicated cloud just for you.
Think of it as a private corridor from Vercel's network to a published AWS service. A VPC endpoint is the door into that corridor. VPC means virtual private cloud, which is AWS's isolated network boundary. Using 2 Availability Zones means Vercel places the endpoint across 2 zones supported by that service.
When you create a connection, Vercel provisions a dedicated endpoint for your team in 2 Availability Zones supported by the target service. Vercel also assigns your team an AWS IAM role, which is the identity the service owner can allow, and gives the connection a stable hostname:
<service>.team_<team-id>.endpoints.vercel.com
Your deployed Functions and your build jobs use that hostname. Traffic for the target service goes through the private endpoint, while Vercel records transfer usage for that connection.
That last detail is the whole mechanism. Your application still talks to a hostname. The network decides that packets for that hostname take the private path.
The change matters on one axis
The axis that moved is network exposure. A Pro team can now keep supported backend traffic off the public internet without stepping up to a dedicated VPC.
This is useful when the target is RDS, Aurora, Neon, Redshift, Snowflake, MongoDB Atlas, Confluent, an internal service behind an AWS Network Load Balancer, or S3 and DynamoDB through gateway endpoints. The target still has to publish an AWS PrivateLink endpoint service. If it doesn't, this feature has nothing to connect to.
The pricing is simple once the Advanced Networking question is settled. The first PrivateLink connection is included with Advanced Networking. Each additional connection costs $30 per month, and Vercel charges $0.04 per GB transferred through PrivateLink.
For a concrete model, say 2 regional connections move 500 GB in total. Transfer is $20. The extra connection adds $30, so the published PrivateLink connection and transfer line is $50 per month.
Hobby users are not included in this release. Teams whose backend is outside AWS, doesn't expose a PrivateLink endpoint, or can safely accept public traffic also see no immediate change.
Pick the network option that matches the wall
These Vercel network routes solve different problems.
PrivateLink sits in the middle. It gives one service a private path, but the underlying VPC is still shared. If your requirement says “single-tenant network,” use Secure Compute. If it says “known IP address” and public routing is acceptable, Static IPs may be enough.
Who can use it tomorrow
A SaaS founder with an AWS database
A founder running the app on Vercel Pro and the database on RDS or Aurora can connect the project to the database's endpoint service, allow the Vercel IAM role, then switch the application's database host to the Vercel-managed hostname.
The payoff is narrow and useful: database traffic gets a private route while the team keeps its existing Vercel deployment flow. This is not full network isolation, but it can remove a public path that was blocking a security review.
A platform engineer exposing an internal API
A platform engineer can place an internal service behind an AWS Network Load Balancer, publish the endpoint service, and allowlist the IAM role Vercel supplies. Functions can then call that service through the stable hostname instead of a public API address.
The payoff is less perimeter work. The service owner approves one AWS principal and keeps the service off the public internet.
A data product team using a managed service
A data product team building on Snowflake, MongoDB Atlas, or Confluent can use the provider's PrivateLink endpoint when that provider offers one in the matching AWS Region. The application and its build jobs get the same private connection.
The payoff is a cleaner path from a Vercel deployment to the data service. The provider's endpoint availability still decides whether the design works.
A multi-region backend team
A backend team running close to users in several regions needs 1 PrivateLink connection per AWS Region. The service must exist in every matching region or support cross-region PrivateLink.
The payoff is lower network exposure without forcing all calls through one region. The trade is equally direct: every extra regional connection adds $30 per month before transfer.
Set it up in the order the network expects
Confirm the target qualifies
Get the AWS endpoint service name and Region from the service owner or provider. The service must accept all AWS principals or allowlist the IAM role Vercel gives your team.
Enable the Vercel network feature
Open the project, then go to Settings, Networking, Advanced Networking, and AWS PrivateLink. Enable Advanced Networking if it isn't already active for the team.
Create the connection
Select New Connection, enter the endpoint service name, choose the matching Region, and decide whether to enable Private DNS.
Use Vercel's hostname
Point the application's service host at the stable
endpoints.vercel.comhostname Vercel creates. Don't assume the provider's private hosted-zone name will resolve from Vercel's shared network.Redeploy and verify
Redeploy the project, then confirm both runtime requests and any build-time requests to the backend succeed through the connection.
The common mistake is DNS. Interface endpoints on Vercel's shared network cannot use the provider's private hosted zone. Use the Vercel-managed hostname, not the AWS-generated endpoint name or the provider's public hostname.
The honest limits
Each connection exists in 1 AWS Region. A project assignment covers every environment in that project, so you cannot turn PrivateLink on for production and keep it off for preview inside the same project.
Routing Middleware is also outside the path because it runs at the edge. Only interface endpoints and gateway endpoints are supported. Gateway Load Balancer endpoints and resource endpoints are not.
PrivateLink solves network routing, not application authorization. Your database password, IAM policy, service token, and user permissions still matter. For agent apps that need managed provider credentials, Vercel Connect is the separate authentication layer.
What to do now
Act this week if you're on Pro or Enterprise, your target already exposes an AWS PrivateLink endpoint, and removing the public network hop closes a real security or compliance gap. Start with a service in its AWS Region, then verify runtime and build traffic before adding regions.
Wait if the provider cannot give you an endpoint service name, if you need different network rules for preview and production inside one project, or if the team hasn't confirmed the Advanced Networking price.
Use Static IPs instead when the backend only needs an IP allowlist and public routing is acceptable. Use Secure Compute when the requirement is a dedicated VPC or VPC peering. Teams on Hobby and teams calling services outside AWS are unaffected by this release.
Sep 1, 2026
Prefer this site in Google
Mark omidsaffari.com as preferred and Google lifts it in Top Stories, AI Overviews and AI Mode for you.
