Bedrock PrivateLink: Claude without public internet

TL;DR

Bedrock PrivateLink puts an interface endpoint in your VPC, usually Frankfurt. Claude calls then need no internet gateway, NAT, VPN or Direct Connect. Residency is the EU profile eu.anthropic.claude-sonnet-5-5. PrivateLink is the network path, not the residency switch. FIPS endpoint services do not exist in the EU.

What is Bedrock PrivateLink and what does it not do?

Bedrock PrivateLink is an interface VPC endpoint powered by AWS PrivateLink. Instances in the VPC call Amazon Bedrock as if the service sat inside the VPC. They do not need public IPs. The endpoint does not set an EU profile, a retention mode or a processing addendum. Without an eu. model ID the request can still run anywhere.

The Bedrock interface endpoint page lists five service names: com.amazonaws.region.bedrock (control plane), bedrock-runtime (inference), bedrock-mantle, bedrock-agent and bedrock-agent-runtime. FIPS variants bedrock-fips and bedrock-runtime-fips exist only in us-east-1, us-east-2, us-west-2, ca-central-1, us-gov-east-1 and us-gov-west-1. Frankfurt, Ireland and Paris do not offer those names.

AWS creates a requester-managed network interface in each subnet you enable. That interface is the entry point for traffic to Bedrock. The VPC and PrivateLink overview also uses this pattern for batch jobs, customisation and Knowledge Bases. The inference endpoints page adds the cost reason: traffic stays on the AWS network and avoids NAT or internet-gateway egress charges.

With private DNS (the default except for S3) the hostnames stay bedrock-runtime.eu-central-1.amazonaws.com and bedrock-mantle.eu-central-1.api.aws. SDK code does not change. Without private DNS you pass https://vpce-id.bedrock-runtime.eu-central-1.vpce.amazonaws.com. Bedrock basics, and why the global sample leaves the EU, are in Amazon Bedrock in Europe.

We recommend PrivateLink in every production VPC that calls Claude and has no public egress. A sandbox with NAT can keep the public regional endpoint, as long as the EU profile is set.

How do you create the VPC endpoint in Frankfurt?

You create an interface endpoint in eu-central-1 on com.amazonaws.eu-central-1.bedrock-runtime, with private DNS, a security group on port 443 and an endpoint policy that allows only InvokeModel. The EU profile remains the model ID. Miss either piece and you get public egress or global processing.

The create interface endpoint guide requires DNS hostnames and DNS resolution on the VPC. The endpoint security group must allow inbound HTTPS from the application subnets. Interface endpoints do not answer ping; use nc or nmap on port 443. One subnet per Availability Zone, never two in the same zone. The first four IPs and the last IP of each subnet CIDR are reserved.

1. Open the Amazon VPC console, choose Endpoints, then Create endpoint.
2. Type: AWS services. Service name: com.amazonaws.eu-central-1.bedrock-runtime.
3. Pick the VPC and one subnet per zone, at least two zones for failover.
4. Leave Enable DNS name on. For Bedrock that is the default.
5. Attach a security group that allows TCP 443 from the app subnets.
6. Policy: Custom, not Full access. Use the sample below.
7. Add a second endpoint for com.amazonaws.eu-central-1.bedrock if the control plane (model list, inference profiles) must also run without NAT.
8. Test the call from an instance inside the VPC, not from your laptop.

AWS publishes this endpoint policy as a starting point. It allows inference only:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Principal": "*",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "*"
    }
  ]
}

With private DNS the usual client is enough. Without private DNS set endpoint_url. The AWS sample uses us-east-1 and a global model ID. For the EU replace both:

# pip install boto3
import boto3

client = boto3.client(
    "bedrock-runtime",
    region_name="eu-central-1",
    # Only if private DNS is off:
    # endpoint_url="https://vpce-xxxxxxxx.bedrock-runtime.eu-central-1.vpce.amazonaws.com",
)

response = client.converse(
    modelId="eu.anthropic.claude-sonnet-5-5",
    messages=[{"role": "user", "content": [{"text": "Name the EU source Region."}]}],
    inferenceConfig={"maxTokens": 256},
)

for block in response["output"]["message"]["content"]:
    if "text" in block:
        print(block["text"])

IAM is still required. The EU profile needs rights on the inference profile and on the foundation model in every destination Region. The IAM shape, and why Frankfurt alone is not enough, is in Claude on AWS Bedrock in the EU.

What does Bedrock PrivateLink cost on top of tokens?

PrivateLink is a network price, not a token surcharge. The PrivateLink pricing page charges 0.01 USD per GB for the first petabyte, 0.006 USD for the next 4 PB and 0.004 USD above 5 PB. The worked example on that page bills 0.01 USD per hour per endpoint ENI. Partial hours bill as a full hour. The token row stays the Sonnet list plus 10 percent on a regional endpoint.

Anthropic pricing on 25 October 2026 lists Sonnet 5.5 at 2 USD input and 10 USD output per million tokens. From Sonnet 4.5, Haiku 4.5 and Opus 4.5, regional and multi-region endpoints add 10 percent. US-only (inference_geo: "us" or Foundry Data Zone Standard US) is 1.1x. One CCU is 0.01 USD; 100 CCU equal 1 USD. Haiku 5.5 is 0.10 / 0.50 up to 100,000 prompt tokens and 0.50 / 2.50 above. Batch halves both sides and sits outside Zero Data Retention.

Line	Rate (verified 25 Oct 2026)	What you pay
Interface endpoint, example ENI	0.01 USD / hour	3 zones × 0.01 × 24 × 30 = 21.60 USD / month, our arithmetic on the example rate
Data through the endpoint	0.01 USD / GB to 1 PB	100 GB of request and response bodies: 1 USD
Sonnet 5.5 global	2 / 10 USD per million tokens	20M in + 2M out: 60 USD
Sonnet 5.5 EU endpoint (+10 %)	2.20 / 11 USD	Same volume: 66 USD
Google PSC to Google APIs	0.01 USD / hour, no data charge on that row	Hours only if you use the global API path
Google PSC to regional APIs	0.01 USD / hour plus 0.01 USD / GiB to 1 PiB	The Claude EU host aiplatform.eu.rep.googleapis.com sits in this class

The 21.60 USD figure is not an AWS quote. The pricing page states the hourly rate in a US-East-1 example. Other Regions may differ; the GB tiers have no Region caveat. Azure Private Link shows placeholders on the public pricing page. We do not invent a Foundry dollar amount.

Tokens dominate. 66 USD on the EU row plus 21.60 USD for three ENIs plus 1 USD for 100 GB of network is 88.60 USD. NAT instead of PrivateLink skips the ENIs and pays egress through the NAT gateway. AWS names that egress charge as the reason to use a VPC endpoint.

We recommend PrivateLink once the VPC must have no public egress. Twenty-two dollars is smaller than one global run on sensitive prompts. Token rows across clouds sit in Claude API pricing for the EU.

Do prompts stay in the EU when you use PrivateLink?

No, not from PrivateLink alone. PrivateLink keeps the path between the VPC and the Bedrock API private. Where Bedrock runs inference is the inference profile. From Frankfurt, eu.anthropic.claude-sonnet-5-5 routes to Frankfurt, Stockholm, Milan, Spain, Ireland and Paris. In-region on bedrock-runtime is not available for Sonnet 5.5.

The Sonnet 5.5 model card lists launch on 28 September 2026, EOL no sooner than 28 September 2027, 1 million token context, 128,000 token output, June 2026 cutoff. Cache minimum 512 tokens, at most 4 checkpoints, TTL 5 minutes and 1 hour. Call the same profile from London or Zurich and those cities join the destination list. Both sit outside the EU. A PrivateLink endpoint in Frankfurt does not change that list.

Geographic cross-Region inference keeps processing inside the geography. Prompts and outputs can leave the source Region. Abuse-detection storage sits in the destination Region. An SCP that allows only eu-central-1 breaks the profile when AWS routes to Ireland or Paris. Allow all six destinations or add an exception on bedrock:InferenceProfileArn.

PrivateLink and residency are two switches. The residency switch, workspace geo and inference_geo are in Claude data residency in the EU. Retention (none vs aws_review) is the third switch; the feature table is in Claude Zero Data Retention in the EU.

PrivateLink, Private Service Connect or Foundry Private Link?

Only Bedrock pairs a private path with EU processing in a setup you build yourself. Google offers Private Service Connect to the EU host. Foundry has a private endpoint and no EU data zone for Claude. If you need EU residency and a private network, stay on Bedrock or Google Europe, not Foundry.

Google documents regional PSC endpoints in the regional Google APIs guide. The endpoint lives in one Region and targets a regional or multi-region API host. Network pricing lists 0.01 USD per hour. The “access Google APIs” row has no data charge. The “regional endpoints of Google APIs” row adds consumer data processing: 0.01 USD per GiB to 1 PiB, 0.006 to 5 PiB, 0.004 above. The Claude EU host aiplatform.eu.rep.googleapis.com is a multi-region endpoint. Data residency excludes the United Kingdom and Switzerland from the Europe endpoint. Private Google Access does not cover multi-region; that is already in Claude on Vertex AI in Europe.

Foundry isolates inbound traffic with a private endpoint, documented in network isolation. Clients on the VNet resolve the same hostname to the private IP. The hosting comparison: Anthropic is seller and processor. Deployment types are Global Standard and Data Zone Standard (US). There is no EU zone. The private endpoint keeps the path private and processing global or in the United States. Foundry detail is in Azure AI Foundry in Europe.

Question	Bedrock PrivateLink	Google PSC	Foundry Private Link
Private path to the API	Yes, interface endpoint	Yes, regional PSC endpoint	Yes, private endpoint
EU processing	Yes, with the eu. profile	Yes, Europe endpoint, no UK or CH	No, Global or US zone only
FIPS in the EU	No	Not in this form	Not documented as EU FIPS
Hourly price (public)	0.01 USD / ENI in the example	0.01 USD / endpoint	Public page has no number
Data price	0.01 USD / GB to 1 PB	0 or 0.01 USD / GiB, by row	Not quotable

We recommend Bedrock plus PrivateLink when IAM, quotas and the AWS bill are already fixed. Google plus PSC when Fable 5.1 must stay in the EU. Foundry only when MACC drives the invoice and US processing is acceptable.

FAQ

Does Bedrock PrivateLink need an internet gateway?

No. The Bedrock page says you do not need an internet gateway, NAT device, VPN or Direct Connect. Instances do not need public IPs. DNS hostnames and DNS resolution on the VPC must be on, or private DNS will not resolve.

What does Bedrock PrivateLink cost per month?

The pricing page lists 0.01 USD per GB to 1 PB and, in the example, 0.01 USD per hour per ENI. Three zones, 30 days of 24 hours: 21.60 USD before data, our arithmetic. 100 GB of bodies cost 1 USD. The token row (66 USD for 20 plus 2 million Sonnet 5.5 tokens on the EU endpoint) stays the larger bill.

PrivateLink or NAT gateway: which should EU teams pick?

PrivateLink, once the VPC must have no public egress or compliance wants the path on AWS. NAT keeps the public Bedrock host reachable and pays egress. AWS names that egress charge as the reason for a VPC endpoint. Neither product sets residency.

Does one endpoint cover control plane and runtime?

No. bedrock-runtime carries Invoke and Converse. bedrock carries list calls, inference profiles and retention. bedrock-mantle is a separate service name with host bedrock-mantle.region.api.aws. Without a control-plane endpoint, get-inference-profile fails in a VPC with no NAT, while Converse still works.

Are there FIPS endpoints for Bedrock in Frankfurt?

No. AWS lists bedrock-fips and bedrock-runtime-fips only for us-east-1, us-east-2, us-west-2, ca-central-1, us-gov-east-1 and us-gov-west-1. A team with a FIPS mandate needs another product or a US Region, not Frankfurt.

Does PrivateLink change prompt retention?

No. Retention stays none, default or aws_review per Region. PrivateLink sees the payload in transit and does not store it as a Bedrock log. Your own model invocation logging still writes to CloudWatch or S3 if you turn it on.

Sources

1. AWS Bedrock: Interface VPC endpoints (PrivateLink) (25 October 2026)
2. AWS Bedrock: Protect data with VPC and PrivateLink (25 October 2026)
3. AWS Bedrock: Inference endpoints (25 October 2026)
4. AWS Bedrock: Claude Sonnet 5.5 model card (25 October 2026)
5. AWS Bedrock: Geographic cross-Region inference (25 October 2026)
6. AWS PrivateLink pricing (25 October 2026)
7. AWS PrivateLink: Create an interface endpoint (25 October 2026)
8. Anthropic: Pricing (25 October 2026)
9. Google Cloud: Access regional Google APIs via PSC (25 October 2026)
10. Google Cloud: Network pricing (Private Service Connect) (25 October 2026)
11. Google Cloud: Data residency (25 October 2026)
12. Microsoft Learn: Foundry network isolation (25 October 2026)
13. Microsoft Learn: Claude hosting comparison (25 October 2026)