AWS Unveils 'Private Connections' for DevOps Agent to Link Private Services Within VPC

AWS has released the Private Connections feature for AWS DevOps Agent. This feature allows the Agent to fully manage Amazon VPC Lattice-based resource gateways, enabling secure communication with MCP servers, Grafana, and other services inside the VPC without exposing them to the public internet.

Security and Network Control

Private connections create ENIs (Elastic Network Interfaces) only in specified subnets, serving as entry points for private traffic. Users directly manage security groups and control traffic using outbound/inbound rules. To enforce the principle of least privilege, access is permitted only to resources tagged with AWSAIDevOpsManaged. DNS resolution can be configured in either Public mode, which requires public records, or In VPC mode, which resolves only private hosted zones.

Creation and Integration Procedure

Create connections via the Console or CLI (aws devops-agent create-private-connection) by specifying the VPC, subnets, IP type, and port range. Creation takes up to 10 minutes, and confirmation of the Active status is required. For Grafana integration, the official open-source Grafana MCP server (v9.1 or higher) is supported; register it by creating a service account token with the Viewer role and specifying the private connection. Multiple services can be integrated into a single private connection via TLS Host header/SNI-based routing.

Advanced Configuration and Management

In Self-managed mode, you can directly provide an existing VPC Lattice resourceConfigurationId to implement multi-account sharing or hub-and-spoke architectures. In this case, you must verify that VPC Lattice actions are allowed in your organization's SCPs. Unnecessary private connections should be deleted via the Console or CLI (aws devops-agent delete-private-connection) to prevent ongoing costs; upon deletion, the managed resource gateway and ENI are removed from the VPC.