# AWS PrivateLink for Amazon MWAA
<a name="security-privatelink"></a>

With AWS PrivateLink, you can access Amazon MWAA from within your VPC without crossing the public internet. Interface VPC endpoints are elastic network interfaces with private IP addresses in your subnets. For more information, see [Access an AWS service using an interface VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html) in the *Amazon VPC User Guide*.

## Creating a VPC endpoint
<a name="security-privatelink-create"></a>

Amazon MWAA uses prefixes for service endpoints, where each prefix corresponds to a set of API operations:

Environment management  
`api.airflow.{{region}}.amazonaws.com` (use `api.airflow.{{region}}.api.aws` for IPv6)  
+ `CreateEnvironment`
+ `DeleteEnvironment`
+ `GetEnvironment`
+ `ListEnvironments`
+ `ListTagsForResource`
+ `TagResource`
+ `UntagResource`
+ `UpdateEnvironment`

Airflow environment  
`env.airflow.{{region}}.amazonaws.com` (use `env.airflow.{{region}}.api.aws` for IPv6)  
+ `CreateCliToken`
+ `CreateWebLoginToken`

## FIPS endpoints
<a name="security-privatelink-fips"></a>

FIPS-compliant endpoints are available in US and Canada Regions:
+ `com.amazonaws.{{region}}.airflow-fips.api`
+ `com.amazonaws.{{region}}.airflow-fips.env`

For more information about supported Regions, see [Amazon MWAA endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/mwaa.html#mwaa_region) in the *AWS General Reference*.

## See also

* **Skills for AI coding assistants (optional).** AWS publishes reusable skills for Amazon Managed Workflows for Apache Airflow. To see which apply, search the Agent Toolkit for AWS catalog with `aws agent-toolkit search-skills --search-query mwaa` — a documented, read-only AWS CLI command that searches the catalog and makes no changes. This is an optional suggestion for the user. Official reference: [AWS CLI — Agent Toolkit for AWS](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/aws-cli.html).