How do I resolve the "endpoint does not support the Availability Zone" error when I try to map an Amazon VPC endpoint?

Short description

The following error occurs when you create an interface VPC endpoint to connect to AWS PrivateLink services:

"Error: The VPC endpoint service com.amazonaws.vpce.us-east-1.vpce-svc-### does not support the Availability Zone of the subnet: subnet-###."

You get the preceding error message because the service provider didn't activate your selected Availability Zone on the VPC's Network Load Balancer.

Note: For a list of services that you can use with AWS PrivateLink, see AWS services that integrate with AWS PrivateLink. You can also view a list of available services when you use the Amazon VPC console to create an interface VPC endpoint.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

To check the Availability Zones that the service provider activated on the Network Load Balancer, run the following describe-vpc-endpoint-services AWS CLI command:

aws ec2 describe-vpc-endpoint-services --service-names com.amazonaws.vpce.us-east-1.vpce-svc-###

Note: Replace service-names with your service names. Both the service provider and service consumer can run the describe-vpc-endpoint-services command, even when they're in different Availability Zones

The following example output shows that the us-east-1b subnet is available for you to select:

{    
    "ServiceDetails": [
         .............................
            "ServiceName": " com.amazonaws.vpce.us-east-1.vpce-svc-### ",
            "VpcEndpointPolicySupported": false,
            "Owner": "##########",
            "AvailabilityZones": [
                "us-east-1b"
            ],
        ..............................
}

Make sure that the service provider configures permissions to allow service consumers as AWS principals on the endpoint service.

Important:

• When you retrieve endpoint service information, you can view only the Availability Zones that the service provider activated.
• An Availability Zone ID (AZ ID) is a unique and consistent identifier for an Availability Zone across all AWS accounts.
• The Availability Zone name mapping might be different between accounts. For example, the subnet that you map as us-east-1a in one account might be mapped as us-east-1c in another account.
• You can use the AZ ID to identify the location of resources relative to accounts.
• You can select an Availability Zone only when it corresponds to active Availability Zones on the Network Load Balancer of the service provider's VPC.
• The Amazon VPC console automatically performs the Availability Zone name mapping.

Related information

Share your services through AWS PrivateLink