Amazon DynamoDB Streams now comes with AWS private link support, allowing you to invoke DynamoDB Streams APIs from within your VPC without traversing the public internet.
With VPC Origins, customers can now have their ALB, NLB, and EC2 instances in a private subnet, which is accessible only through their CloudFront distributions.