Private alias endpoints for isolated virtual networks

A method, comprising:

• receiving, from a client, a request to create a private endpoint (PE) as a routing target for traffic originating from for an isolated virtual network (IVN) established at a provider network in accordance with a request to an application programming interface (API), wherein the traffic is to be delivered to a publicly-accessible service implemented in the provider network;
• and
• configuring, responsive to the request, a tunneling intermediary to perform:
• generating route information indicating that packets directed from the IVN to a public address of the publicly-accessible service are to be directed to the PE;
• generating an encapsulation packet comprising a baseline packet in accordance with the route information, wherein the baseline packet is directed from the IVN to the public address of the publicly-accessible service;
• and
• transmitting the encapsulation packet, from the tunneling intermediary to the publicly-accessible service, without traversing network links outside the provider network.

One or more non-transitory, computer-readable storage media storing instructions that, when executed on or across one or more processors, cause one or more computer systems to:

• receive, from a client, a request to create a private alias endpoint (PAE) as a routing target for traffic originating from for an isolated virtual network (IVN) established at a provider network in accordance with an application programming interface (API), wherein the traffic is to be delivered to a publicly-accessible service implemented in the provider network;
• configure a tunneling intermediary to:
• generate a route table indicating that packets directed from the IVN to a public address of the publicly-accessible service are to be directed to the PAE;
• generate an encapsulation packet comprising a baseline packet in accordance with the route table, wherein the baseline packet is directed from the IVN to the public address of the publicly-accessible service;
• and
• transmit the encapsulation packet, from the tunneling intermediary to the publicly-accessible service, without traversing network links outside the provider network.