Vercel Functions Can Now Reach AWS Databases Off the Public Internet

Vercel made AWS PrivateLink available to Pro and Enterprise teams on September 1, 2026, letting Functions and builds reach AWS-hosted databases and services over a private network path instead of the public internet (Vercel changelog, September 1, 2026).

---

What changed

PrivateLink ships under Advanced Networking. A team opens a project’s Networking settings, enables Advanced Networking, chooses New Connection, and enters the target service’s name and region. Vercel provisions the connection and hands back a stable hostname that Functions and builds use to reach the service privately (Vercel changelog, September 1, 2026).

It only works with services that publish a PrivateLink endpoint on AWS’s side. That covers RDS, Aurora and Neon for databases; Snowflake and MongoDB Atlas among SaaS platforms; internal services sitting behind an AWS Network Load Balancer; and S3 or DynamoDB through gateway endpoints (Vercel docs, AWS PrivateLink).

The first connection is included with Advanced Networking. Each additional connection runs $30 a month, plus $0.04 per GB of data transferred (Vercel docs, AWS PrivateLink).

Where it sits next to Secure Compute

Vercel already sold two ways to lock down outbound traffic: Static IPs, for allowlisting a database or third-party API by address, and Secure Compute, which places deployments in a dedicated private network with VPC peering for teams that need regional failover or a compliance program built around isolated infrastructure (Vercel docs, Secure Compute).

PrivateLink is narrower than either. It doesn’t peer networks or hand out a routable IP range, and it only works when the AWS-hosted service on the other end has already published an endpoint service for it to connect to. In exchange, a team skips both the allowlist upkeep of Static IPs and the network-architecture commitment of Secure Compute for the specific case of talking to an AWS resource.

Our take

The case this targets is a plain one: a Vercel-deployed app whose database lives on RDS or Aurora. Before September 1, keeping that path off the open internet meant either a Secure Compute VPC peering setup sized for a much bigger networking problem, or a static IP an AWS security group allowlists. The allowlist works fine until someone forgets to update it during a migration or a region failover. PrivateLink replaces that with a connection scoped to exactly one service, which is a better match for the actual requirement most teams have.

The trade-off is the same one running through Vercel’s enterprise features this year: it sits behind Pro and Enterprise, not Hobby, so the teams most likely to be gluing a side project to a free-tier RDS instance over an open port don’t get it. That’s a defensible product line to draw. PrivateLink is infrastructure spend, not a toggle, but the security posture upgrade tracks the invoice, not the risk.

Key Takeaways

• AWS PrivateLink reached general availability on Vercel’s Pro and Enterprise plans September 1, 2026, under Advanced Networking.
• It connects Functions and builds to AWS-hosted services that publish a PrivateLink endpoint: RDS, Aurora, Neon, Snowflake, MongoDB Atlas, internal AWS Network Load Balancer services, and S3/DynamoDB gateway endpoints.
• The first connection is included with Advanced Networking; additional connections cost $30/month plus $0.04/GB transferred.
• It’s a narrower tool than Secure Compute’s VPC peering or Static IPs’ allowlisting, scoped to one AWS service at a time, with no network peering or dedicated IP range.