Vercel Opens a Private Lane to AWS Databases for Pro Teams

Vercel now lets Pro and Enterprise teams connect Functions and builds directly to AWS-hosted services over AWS PrivateLink, keeping database traffic off the public internet without requiring the full VPC-peering setup Vercel previously reserved for its priciest tier (Vercel changelog, Sept. 1, 2026).

---

What changed

PrivateLink connections reach AWS RDS, Aurora and Neon databases, SaaS services such as Snowflake and MongoDB Atlas, anything sitting behind an AWS Network Load Balancer, and S3 or DynamoDB through gateway endpoints (Vercel changelog, Sept. 1, 2026). Setup runs through a project’s Networking settings: enable Advanced Networking, start a new connection, and supply the target service name and AWS region. The service on the other end has to accept connections from all AWS principals or allowlist the IAM role Vercel provides; once that’s done, Vercel hands back a stable hostname Functions and builds use to reach it privately (Vercel docs, AWS PrivateLink).

The first connection is included with Advanced Networking. Additional connections cost $30 a month, and data transfer over PrivateLink runs $0.04 per GB. Each connection is scoped to a single AWS region, so a multi-region service needs one connection per region.

PrivateLink sits below Vercel’s existing Secure Compute product, not in place of it. Secure Compute uses VPC peering to put a team’s deployments in a fully isolated private network with dedicated IPs. It’s heavier to configure, and until this year it was gated to Enterprise, before Vercel opened self-serve setup there in January and flagged Pro support as coming (Vercel changelog, Jan. 7, 2026). PrivateLink connections, by contrast, share their underlying VPC across customers and only cover services that publish a PrivateLink endpoint: a narrower, lighter-weight option that ships to Pro teams now rather than later.

Our take

The gap this closes is a specific one. Vercel added AWS-hosted databases (Aurora Postgres, Aurora DSQL, DynamoDB) to its Marketplace back in December (AWS, Dec. 17, 2025), but a Pro team wiring a Function to one of those databases still had to either accept public-internet exposure or absorb Secure Compute’s Enterprise-grade setup to avoid it. PrivateLink is the missing middle: private connectivity sized for a team that has a production Postgres instance to protect, not a full private network to manage.

It’s also a bet that most of Vercel’s Pro base needs “reach this one database privately,” not “isolate our entire deployment.” Scoping each connection to a single service and region, rather than peering whole networks, keeps the product simple to reason about — and cheap enough that a team doesn’t need an enterprise contract to stop sending query traffic over the open internet.

Key Takeaways

• AWS PrivateLink is now self-serve on Vercel Pro and Enterprise via Advanced Networking, not just Enterprise-only Secure Compute.
• It reaches RDS, Aurora, Neon, Snowflake, MongoDB Atlas, AWS Network Load Balancer targets, and S3/DynamoDB gateway endpoints.
• First connection is included; additional connections are $30/month plus $0.04/GB in data transfer, one connection per AWS region.
• It complements rather than replaces Secure Compute: PrivateLink is narrower and shares its underlying VPC, while Secure Compute gives full VPC-peered isolation.