[Yandex Cloud documentation](../../index.md) > [Yandex Virtual Private Cloud](../index.md) > [Concepts](index.md) > Service connections

# Service connections in Yandex Virtual Private Cloud


**Service connection** (VPC private endpoint) enables cloud resources within VPC to connect to Yandex Cloud services over the internal network without using [public IP addresses](address.md#public-addresses).

Yandex Cloud services remain accessible via both public IPs and service connections. 

Service connections are regional and distributed across availability zones. If there is a failure in one zone, traffic is automatically rerouted to other zones.

Bandwidth for an individual service connection is not guaranteed and depends on the current workload on the target service. For stable operation, monitor usage via [monitoring](../metrics.md) and adhere to [limits in place](limits.md#vpc-limits).

A service connection can be divided into two parts:

* A **private endpoint** (PE) represents (connects) the target service within VPC. It is implemented within VPC. This is a common part for all types of service connections.
* **Provider** stands for integration implemented on the target service side to interact with the private endpoint.

## How to use service connections {#pe-notes1}

Within a single [virtual network](network.md#network), you can create service connections of [different types](#pe-services), but only one connection per type. Creating two or more connections of the same type is not allowed.

The private endpoint is assigned an IP address from the subnets' CIDR ranges in the VPC network where the service connection is being created. Once you service connection is created, all cloud resources in that network gain IP connectivity to the target service.

Upon creation, every private endpoint automatically gets a **PE record**, which is an A-type DNS record with a special FQDN for that service connection. For example, for [Object Storage](../../storage/index.md), the PE record would be `storage.pe.yandexcloud.net`.

Optionally, you can also create a **Primary record**, i.e., an A-type DNS record for the service's public FQDN. It will also include the internal IP address allocated for the service connection. This is defined by the `private-dns-records-enabled` parameter. For [Object Storage](../../storage/index.md), the Primary record would be `storage.yandexcloud.net`.

These A-type DNS records are created in the [internal service zone](../../dns/concepts/dns-zone.md#service-zones).

When using [Cloud Interconnect](../../interconnect/index.md), the service connection is accessible via [private connections](../../interconnect/concepts/priv-con.md), just like other VPC resources. To access the service connection via FQDN from outside Yandex Cloud, configure A-type records on your corporate DNS server so that the service's FQDN resolves to the corresponding service connection IP address.

## Service connection types {#pe-services}

Currently, you can create service connections for the following cloud services:

| **Service name** | **Creation method** | **PE record** | **Primary record** |
| --- | --- | --- | --- |
| [Object Storage](../../storage/index.md) | [UI, CLI, Terraform](../operations/private-endpoint-create.md) | `storage.pe.yandexcloud.net` | `storage.yandexcloud.net` |
| [Cloud Registry](../../cloud-registry/index.md) | [Contacting support](../operations/private-endpoint-create.md) | `registry.pe.yandexcloud.net` | `registry.yandexcloud.net` |
| [AI Studio](../../ai-studio/concepts/) | [Contacting support](../operations/private-endpoint-create.md) | `ai.pe.api.cloud.yandex.net` | `ai.api.cloud.yandex.net` |
| [Managed Service for Trino](../../managed-trino/index.md) | [Contacting support](../operations/private-endpoint-create.md) | `trino.pe.yandexcloud.net`, `*.trino.pe.yandexcloud.net` | - |
| [Serverless Containers](../../serverless-containers/index.md) |  [Contacting support](../operations/private-endpoint-create.md) | `*.containers.pe.yandexcloud.net` | `*.containers.yandexcloud.net` |
| [Cloud Functions](../../functions/index.md) | [Contacting support](../operations/private-endpoint-create.md) | `functions.pe.yandexcloud.net` | `functions.yandexcloud.net` |
| Public API Gateway | [Contacting support](../operations/private-endpoint-create.md) | `-` | `*.api.cloud.yandex.net` |
| [AI Studio MCP Gateway](https://aistudio.yandex.ru/docs/ai-studio/mcp-gateway/api-ref/) |  [Contacting support](../operations/private-endpoint-create.md) | `*.mcpgw.serverless.pe.yandexcloud.net` | `*.mcpgw.serverless.yandexcloud.net` |

## How to use certain types of service connections {#pe-notes2}

### Object Storage {#pe-s3}

#### Bucket policies

To allow access to Object Storage only from VPC via a service connection, you must apply the following access policy to the bucket:

```json
{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Principal": "*",
    "Action": "*",
    "Resource": [
      "arn:aws:s3:::<bucket_name>/*",
      "arn:aws:s3:::<bucket_name>"
    ],
    "Condition": {
      "StringEquals": {
        "yc:private-endpoint-id": "<connection_ID>"
      }
    }
  }
}
```

Where:

* `<bucket_name>`: Name of the bucket in Object Storage to which you need to apply the access policy, e.g., `my-s3-bucket`.
* `<connection_ID>`: Service connection ID (private endpoint), e.g., `enpd7rq1s3f5********`.

### Cloud Registry {#pe-cr}

Before creating a service connection for Cloud Registry, you must first create a service connection for Object Storage.

### Public API Gateway {#pe-pubapi}

This PE type currently has the following limitations:
1. PE-record-only access is not supported. When creating this PE type, you must always ensure Primary record creation.
1. The following services are not supported when accessed via PE:
   * [Certificate Manager](../../certificate-manager/index.md)
   * [Lockbox](../../lockbox/index.md)
   * [Cloud Backup](../../backup/index.md)
   * [Object Storage S3 API](../../storage/s3/index.md)


## Examples of connecting to services without a VPC PE {#no-pe-examples}

* [Connecting to Object Storage from Virtual Private Cloud](../tutorials/storage-vpc-access.md)
* [Connecting to Container Registry from Virtual Private Cloud](../tutorials/vpc-cr-access.md)