Edit this page
Report an issueCreate a private connection with AWS PrivateLink
Connect your data plane to your Konnect control plane or make Konnect API calls (including Admin API calls for control plane configuration) with a private connection to stay compliant and save data transfer costs
You can establish a private connection to ensure that the data transmitted between Konnect and your AWS environment is secure. This private connection uses AWS PrivateLink and is available for the following AWS regions:
- us-east-2
- us-west-2
- eu-central-1
- eu-west-1
- eu-west-2
- ap-southeast-1
- ap-southeast-2
If you want to create a connection with a different AWS region, contact Kong Support.
Prerequisites
Create a VPC, subnets, and a security group in AWS. For more information, see the AWS documentation.
Steps
Control Plane <> Data Plane Communication
Konnect Admin API
-
In the AWS Console, connect to your data plane region, open the Endpoints section of the VPC dashboard and create a new endpoint.
-
Enter a name tag for the endpoint that includes the Konnect control plane geo that you want to connect to. For example:
konnect-us-geo. -
Select the Endpoint services that use NLBs and GWLBs service category.
-
Find the correct service name for your region in the tables below. Open the tab that matches your AWS region and use the PrivateLink service name for your Konnect geo. For example,
com.amazonaws.vpce.us-east-2.vpce-svc-096fe7ba54ebc32dbfor the us-east-2 AWS region and US Konnect geo.ap-southeast-1ap-southeast-2eu-central-1eu-west-1eu-west-2us-east-2us-west-2Konnect Geographical Region PrivateLink service name Private DNS name AP com.amazonaws.vpce.ap-southeast-1.vpce-svc-08f76d27d29b02a09 ap.svc.konghq.com EU com.amazonaws.vpce.ap-southeast-1.vpce-svc-0a04604ecaed18457 eu.svc.konghq.com GLOBAL com.amazonaws.vpce.ap-southeast-1.vpce-svc-0b1da0ec96942fdb0 global.svc.konghq.com IN com.amazonaws.vpce.ap-southeast-1.vpce-svc-0c6699c89ac27323c in.svc.konghq.com ME com.amazonaws.vpce.ap-southeast-1.vpce-svc-00689717c9085d08a me.svc.konghq.com US com.amazonaws.vpce.ap-southeast-1.vpce-svc-0eeaa22ed2d6268eb us.svc.konghq.com Konnect Geographical Region PrivateLink service name Private DNS name AP com.amazonaws.vpce.ap-southeast-2.vpce-svc-055ba6ff5a3f551c9 ap.svc.konghq.com EU com.amazonaws.vpce.ap-southeast-2.vpce-svc-02a339e8dc8ec72c6 eu.svc.konghq.com GLOBAL com.amazonaws.vpce.ap-southeast-2.vpce-svc-0dddc28f5f8b68cbc global.svc.konghq.com IN com.amazonaws.vpce.ap-southeast-2.vpce-svc-050ea149424be6d3c in.svc.konghq.com ME com.amazonaws.vpce.ap-southeast-2.vpce-svc-008f231c7501e72c2 me.svc.konghq.com US com.amazonaws.vpce.ap-southeast-2.vpce-svc-0600dd84f39e7b12a us.svc.konghq.com Konnect Geographical Region PrivateLink service name Private DNS name AP com.amazonaws.vpce.eu-central-1.vpce-svc-0c3f0574080bdd859 ap.svc.konghq.com EU com.amazonaws.vpce.eu-central-1.vpce-svc-05e6822fbce58e1a0 eu.svc.konghq.com GLOBAL com.amazonaws.vpce.eu-central-1.vpce-svc-050c17c4f2970705f global.svc.konghq.com IN com.amazonaws.vpce.eu-central-1.vpce-svc-0a5c165336502e526 in.svc.konghq.com ME com.amazonaws.vpce.eu-central-1.vpce-svc-0e6497e6df9928a80 me.svc.konghq.com US com.amazonaws.vpce.eu-central-1.vpce-svc-01d3dd232e277feeb us.svc.konghq.com Konnect Geographical Region PrivateLink service name Private DNS name AP com.amazonaws.vpce.eu-west-1.vpce-svc-08edf59f8bc1d2262 ap.svc.konghq.com EU com.amazonaws.vpce.eu-west-1.vpce-svc-037bd988d9a9d4e3a eu.svc.konghq.com GLOBAL com.amazonaws.vpce.eu-west-1.vpce-svc-0852df4643d76b28e global.svc.konghq.com IN com.amazonaws.vpce.eu-west-1.vpce-svc-029c2f6bedf7c346f in.svc.konghq.com ME com.amazonaws.vpce.eu-west-1.vpce-svc-0978fbaf50bfc67d9 me.svc.konghq.com US com.amazonaws.vpce.eu-west-1.vpce-svc-01070d7c2137e0ee1 us.svc.konghq.com Konnect Geographical Region PrivateLink service name Private DNS name AP com.amazonaws.vpce.eu-west-2.vpce-svc-0500cb14757738225 ap.svc.konghq.com EU com.amazonaws.vpce.eu-west-2.vpce-svc-0b2d5879e15254e35 eu.svc.konghq.com GLOBAL com.amazonaws.vpce.eu-west-2.vpce-svc-06dfcb0204806e836 global.svc.konghq.com IN com.amazonaws.vpce.eu-west-2.vpce-svc-08e51a56a0ee549c6 in.svc.konghq.com ME com.amazonaws.vpce.eu-west-2.vpce-svc-0ab99eeae8121c7d8 me.svc.konghq.com US com.amazonaws.vpce.eu-west-2.vpce-svc-0c23345bb2ef7b298 us.svc.konghq.com Konnect Geographical Region PrivateLink service name Private DNS name AP com.amazonaws.vpce.us-east-2.vpce-svc-03da89378358921bc ap.svc.konghq.com EU com.amazonaws.vpce.us-east-2.vpce-svc-0cb28c923823735ac eu.svc.konghq.com GLOBAL com.amazonaws.vpce.us-east-2.vpce-svc-0b6f58f5e17620d89 global.svc.konghq.com IN com.amazonaws.vpce.us-east-2.vpce-svc-0b439785c0b06bb97 in.svc.konghq.com ME com.amazonaws.vpce.us-east-2.vpce-svc-0f1c86fb6399d4fe5 me.svc.konghq.com US com.amazonaws.vpce.us-east-2.vpce-svc-096fe7ba54ebc32db us.svc.konghq.com Konnect Geographical Region PrivateLink service name Private DNS name AP com.amazonaws.vpce.us-west-2.vpce-svc-078156c9cc9048988 ap.svc.konghq.com EU com.amazonaws.vpce.us-west-2.vpce-svc-0e03b7c33104a4a4f eu.svc.konghq.com GLOBAL com.amazonaws.vpce.us-west-2.vpce-svc-053325dfb74719cb9 global.svc.konghq.com IN com.amazonaws.vpce.us-west-2.vpce-svc-0865c535fc28a3060 in.svc.konghq.com ME com.amazonaws.vpce.us-west-2.vpce-svc-0fce4d5504650e9a3 me.svc.konghq.com US com.amazonaws.vpce.us-west-2.vpce-svc-0d2994122fea007ca us.svc.konghq.com -
Verify the service. If the service name can’t be verified, contact Kong Support.
- Once the service name is verified, select the VPC, subnets, and security groups to associate with this endpoint. Make sure that:
- The security group accepts inbound traffic on TCP port 443.
- The DNS name parameter in the additional settings is enabled.
-
Create the VPC endpoint and wait for its status to change to available. We recommend waiting for 10 minutes before using it.
- Update your data plane configuration to connect to the control plane through the private connection. Use the private DNS name that matches your control plane geo in the tables above. For the US Konnect geo, the updated Kong data plane configuration in
kong.conflooks like this:cluster_control_plane = us.svc.konghq.com/cp/{cluster_prefix} cluster_server_name = us.svc.konghq.com cluster_telemetry_endpoint = us.svc.konghq.com:443/tp/{cluster_prefix} cluster_telemetry_server_name = us.svc.konghq.com
-
In the AWS Console, connect to region from where Konnect API calls would be made, open the Endpoints section of the VPC dashboard and create a new endpoint.
-
Enter a name tag for the endpoint that includes the Konnect control plane region that you want to connect to. For example:
konnect-us-region. -
Select the Endpoint services that use NLBs and GWLBs service category.
-
Find the correct service name for your region in the tables below. Open the tab that matches your AWS region and use the PrivateLink service name for your Konnect geo. For example,
com.amazonaws.vpce.us-east-2.vpce-svc-096fe7ba54ebc32dbfor the us-east-2 AWS region and US Konnect region.ap-southeast-1ap-southeast-2eu-central-1eu-west-1eu-west-2us-east-2us-west-2Konnect Geographical Region PrivateLink service name Private DNS name AP com.amazonaws.vpce.ap-southeast-1.vpce-svc-08f76d27d29b02a09 ap.svc.konghq.com EU com.amazonaws.vpce.ap-southeast-1.vpce-svc-0a04604ecaed18457 eu.svc.konghq.com GLOBAL com.amazonaws.vpce.ap-southeast-1.vpce-svc-0b1da0ec96942fdb0 global.svc.konghq.com IN com.amazonaws.vpce.ap-southeast-1.vpce-svc-0c6699c89ac27323c in.svc.konghq.com ME com.amazonaws.vpce.ap-southeast-1.vpce-svc-00689717c9085d08a me.svc.konghq.com US com.amazonaws.vpce.ap-southeast-1.vpce-svc-0eeaa22ed2d6268eb us.svc.konghq.com Konnect Geographical Region PrivateLink service name Private DNS name AP com.amazonaws.vpce.ap-southeast-2.vpce-svc-055ba6ff5a3f551c9 ap.svc.konghq.com EU com.amazonaws.vpce.ap-southeast-2.vpce-svc-02a339e8dc8ec72c6 eu.svc.konghq.com GLOBAL com.amazonaws.vpce.ap-southeast-2.vpce-svc-0dddc28f5f8b68cbc global.svc.konghq.com IN com.amazonaws.vpce.ap-southeast-2.vpce-svc-050ea149424be6d3c in.svc.konghq.com ME com.amazonaws.vpce.ap-southeast-2.vpce-svc-008f231c7501e72c2 me.svc.konghq.com US com.amazonaws.vpce.ap-southeast-2.vpce-svc-0600dd84f39e7b12a us.svc.konghq.com Konnect Geographical Region PrivateLink service name Private DNS name AP com.amazonaws.vpce.eu-central-1.vpce-svc-0c3f0574080bdd859 ap.svc.konghq.com EU com.amazonaws.vpce.eu-central-1.vpce-svc-05e6822fbce58e1a0 eu.svc.konghq.com GLOBAL com.amazonaws.vpce.eu-central-1.vpce-svc-050c17c4f2970705f global.svc.konghq.com IN com.amazonaws.vpce.eu-central-1.vpce-svc-0a5c165336502e526 in.svc.konghq.com ME com.amazonaws.vpce.eu-central-1.vpce-svc-0e6497e6df9928a80 me.svc.konghq.com US com.amazonaws.vpce.eu-central-1.vpce-svc-01d3dd232e277feeb us.svc.konghq.com Konnect Geographical Region PrivateLink service name Private DNS name AP com.amazonaws.vpce.eu-west-1.vpce-svc-08edf59f8bc1d2262 ap.svc.konghq.com EU com.amazonaws.vpce.eu-west-1.vpce-svc-037bd988d9a9d4e3a eu.svc.konghq.com GLOBAL com.amazonaws.vpce.eu-west-1.vpce-svc-0852df4643d76b28e global.svc.konghq.com IN com.amazonaws.vpce.eu-west-1.vpce-svc-029c2f6bedf7c346f in.svc.konghq.com ME com.amazonaws.vpce.eu-west-1.vpce-svc-0978fbaf50bfc67d9 me.svc.konghq.com US com.amazonaws.vpce.eu-west-1.vpce-svc-01070d7c2137e0ee1 us.svc.konghq.com Konnect Geographical Region PrivateLink service name Private DNS name AP com.amazonaws.vpce.eu-west-2.vpce-svc-0500cb14757738225 ap.svc.konghq.com EU com.amazonaws.vpce.eu-west-2.vpce-svc-0b2d5879e15254e35 eu.svc.konghq.com GLOBAL com.amazonaws.vpce.eu-west-2.vpce-svc-06dfcb0204806e836 global.svc.konghq.com IN com.amazonaws.vpce.eu-west-2.vpce-svc-08e51a56a0ee549c6 in.svc.konghq.com ME com.amazonaws.vpce.eu-west-2.vpce-svc-0ab99eeae8121c7d8 me.svc.konghq.com US com.amazonaws.vpce.eu-west-2.vpce-svc-0c23345bb2ef7b298 us.svc.konghq.com Konnect Geographical Region PrivateLink service name Private DNS name AP com.amazonaws.vpce.us-east-2.vpce-svc-03da89378358921bc ap.svc.konghq.com EU com.amazonaws.vpce.us-east-2.vpce-svc-0cb28c923823735ac eu.svc.konghq.com GLOBAL com.amazonaws.vpce.us-east-2.vpce-svc-0b6f58f5e17620d89 global.svc.konghq.com IN com.amazonaws.vpce.us-east-2.vpce-svc-0b439785c0b06bb97 in.svc.konghq.com ME com.amazonaws.vpce.us-east-2.vpce-svc-0f1c86fb6399d4fe5 me.svc.konghq.com US com.amazonaws.vpce.us-east-2.vpce-svc-096fe7ba54ebc32db us.svc.konghq.com Konnect Geographical Region PrivateLink service name Private DNS name AP com.amazonaws.vpce.us-west-2.vpce-svc-078156c9cc9048988 ap.svc.konghq.com EU com.amazonaws.vpce.us-west-2.vpce-svc-0e03b7c33104a4a4f eu.svc.konghq.com GLOBAL com.amazonaws.vpce.us-west-2.vpce-svc-053325dfb74719cb9 global.svc.konghq.com IN com.amazonaws.vpce.us-west-2.vpce-svc-0865c535fc28a3060 in.svc.konghq.com ME com.amazonaws.vpce.us-west-2.vpce-svc-0fce4d5504650e9a3 me.svc.konghq.com US com.amazonaws.vpce.us-west-2.vpce-svc-0d2994122fea007ca us.svc.konghq.com -
Verify the service. If the service name can’t be verified, contact Kong Support.
- Once the service name is verified, select the VPC, subnets, and security groups to associate with this endpoint. Make sure that:
- The security group accepts inbound traffic on TCP port 443.
- The DNS name parameter in the additional settings is enabled.
-
Create the VPC endpoint and wait for its status to change to available. We recommend waiting for 10 minutes before using it.
-
Repeat steps 1-7 for
GLOBALKonnect geographical region to make Global API requests. - Konnect Admin API requests or decK commands from dataplane nodes can be made now. Konnect API requests for other regional entities such as Portal can also be made now.
