PrivateLink

AWS PrivateLink exposes a LaserData Managed deployment as a VPC endpoint service. Consumers create interface endpoints, private entry points in their own VPCs. Traffic stays within AWS and does not cross the public internet.

Why PrivateLink

PrivateLink exposes one service rather than connecting two entire VPCs. It has these properties:

• Consumer and deployment address ranges can overlap.
• You can permit other AWS accounts without sharing VPCs.
• Consumers connect to the deployment. The connection does not let the deployment reach into consumer VPCs.
• Multiple consumers can connect independently.

How It Works

A connection follows this sequence:

1. You create an endpoint service for the deployment.
2. LaserData creates the AWS service behind the deployment's Network Load Balancer.
3. Consumers create interface endpoints in their VPCs with the service name.
4. Traffic passes privately through AWS from those endpoints to the deployment.

Prerequisites

You need a running Managed AWS deployment with a Network Load Balancer. The deployment must use Enterprise. The account plan must enable private networking.

Creating an Endpoint Service

From the Console

1. Open your deployment's Networking tab.
2. Click Add PrivateLink.
3. Enter a service name that is unique within the deployment.
4. Choose whether new connections require acceptance. Acceptance is required by default.
5. If access is limited to selected principals, enter their AWS IAM ARNs.
6. Click Create.

An allowed principal is an AWS identity permitted to request access. For example, arn:aws:iam::123456789012:root identifies an account. If the list is empty, any AWS account can discover the service and request a connection. Disable required acceptance only if you trust every allowed principal.

LaserData returns a service name such as com.amazonaws.vpce.us-west-1.vpce-svc-0abc123def.... Consumers use that name to create endpoints.

What Gets Created

LaserData creates and configures these resources:

• An AWS VPC Endpoint Service linked to the deployment's Network Load Balancer.
• The acceptance policy and allowed principals.
• A service name for consumers to use.

Connecting as a Consumer

After the service exists, configure an interface endpoint in the consumer's AWS account.

Step 1 - Create the VPC Endpoint

In the consumer account:

1. Open AWS VPC Console.
2. Open Endpoints and select Create Endpoint.
3. Select Other endpoint services.
4. Enter the service name from the service owner.
5. Click Verify service to make sure that the name resolves.
6. Select the endpoint's VPC, subnets, and security groups.

Step 2 - Accept the Connection (if required)

If acceptance_required is enabled, the owner must approve the request. Open the service's pending connections in LaserData Console. Accept the consumer connection to permit traffic.

Step 3 - Connect

After activation, applications use the endpoint's private DNS name or ENI IP addresses. ENIs are network interfaces attached to the endpoint. Consumers do not need an internet gateway or NAT for this connection.

Managing Endpoint Services

The Networking tab lists service names, acceptance policies, allowed principals, connected endpoints, and their statuses. Deleting a service removes the underlying AWS VPC Endpoint Service. Connected endpoints then stop working. Consumers must remove their endpoint resources separately.

Plan Limits

Audit

The audit log records service creation, configuration details, and the requester. It also records who deleted a service and when.

API Reference

Use API keys for these requests. Creating and deleting services require deployment:network:manage. Listing them requires deployment:network:read.

Create an Endpoint Service

curl -X POST {supervisor_url}/deployments/{deployment_id}/network/aws/private_link \
  -H "ld-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "iggy-endpoint-service",
    "acceptance_required": true,
    "allowed_principals": [
      "arn:aws:iam::123456789012:root"
    ],
    "remarks": "PrivateLink for production consumers"
  }'

List Endpoint Services

curl {supervisor_url}/deployments/{deployment_id}/network/aws/private_link \
  -H "ld-api-key: YOUR_API_KEY"

[
  {
    "id": 1,
    "name": "iggy-endpoint-service",
    "vpc_endpoint_service_id": "vpce-svc-0abc123def456789a",
    "service_name": "com.amazonaws.vpce.us-west-1.vpce-svc-0abc123def456789a",
    "service_type": "Interface",
    "network_load_balancer_arns": ["arn:aws:elasticloadbalancing:us-west-1:987654321098:loadbalancer/net/ld-nlb/abc123"],
    "availability_zones": ["us-west-1a", "us-west-1b"],
    "acceptance_required": true,
    "allowed_principals": ["arn:aws:iam::123456789012:root"],
    "private_dns_name": null,
    "state": "available",
    "remarks": "PrivateLink for production consumers",
    "created_at": "2025-01-15T10:30:00Z",
    "updated_at": "2025-01-15T10:30:00Z"
  }
]

Service states are pending, available, deleting, deleted, and failed.

Delete an Endpoint Service

curl -X DELETE {supervisor_url}/deployments/{deployment_id}/network/aws/private_link/{service_id} \
  -H "ld-api-key: YOUR_API_KEY"