Configure named credentials with an outbound network connection so that API traffic to an AWS account is privately routed and doesn’t traverse the public internet. This feature has been added to non-legacy credentials.
Where: This change applies to Lightning Experience and Salesforce Classic in all editions.
How: When creating a named credential from the UI, select Outbound Network Connection to use a private connection. You can also use the Metadata, Tooling, and Apex ConnectApi APIs to create and edit named credentials.
Make a Private Connection with Named Credentials (salesforce.com)