# Egress PrivateLink Endpoint Setup: ClickHouse on AWS for Confluent Cloud The ClickHouse Sink connector for Confluent Cloud supports AWS PrivateLink connectivity through Egress PrivateLink Endpoints. Use this guide to configure the connector and set up the required endpoints. For fully managed connectors, Confluent Cloud supports two options for private egress to data systems in your AWS network: * **Egress PrivateLink Endpoints** route connector traffic through AWS PrivateLink. For more information, see [Step 2. Create an Egress PrivateLink Endpoint](#cc-clickhouse-sink-eap-aws-create-egress-endpoint). * **Private Network Interface (PNI)** routes connector traffic through Elastic Network Interfaces (ENIs) in your AWS account, without requiring PrivateLink infrastructure. PNI is available for Enterprise and Freight clusters. For setup steps, see [Use Private Network Interface on Confluent Cloud](../../networking/aws-pni.md#cloud-networking-pni-aws). Choose the option that best fits your cluster type and networking requirements. #### NOTE For the ClickHouse Sink connector, PNI applies only when your target is self-managed ClickHouse reachable from your AWS VPC. PNI doesn’t apply if your target is ClickHouse Cloud. ## Prerequisites The following is a list of prerequisites for configuring the ClickHouse Sink connector with an Egress PrivateLink Endpoint: * In Confluent Cloud, one of the following cluster types is set up with the specified network resource: * A Dedicated cluster with a Confluent Cloud network. For the steps to create a Confluent Cloud network, see [Create a Confluent Cloud network](../../networking/ccloud-network/aws.md#ccn-config-aws). The Connection type of the network needs to be “PrivateLink Access”. * A Enterprise cluster with a network gateway For the steps to create a gateway, see [Create a gateway for outbound connectivity in Confluent Cloud](../../networking/aws-egress-privatelink-esku.md#aws-privatelink-egress-create-gateway-esku). * A source topic is created to sink data into the ClickHouse database. * ClickHouse instance is created to sink data into and is running within the same region and cloud as the Confluent Cloud cluster. * A database and a schema are created in ClickHouse to sink data into. ## Step 1. Obtain Endpoint Service name and DNS Name from ClickHouse 1. In the ClickHouse Cloud console, open the service you want to connect via PrivateLink, then navigate to the **Settings** menu. 2. Click **Setup PrivateLink Endpoint** in Private Endpoint section, and make note of ClickHouse Service Name and DNS Name. ![image](connectors/cc-clickhouse-sink-connector/images-clickhouse-eap/clickhouse-dns-service-name.png) ## Step 2. Create an Egress PrivateLink Endpoint ### Dedicated cluster 1. In the **Network management** page or tab of the desired Confluent Cloud environment, click the Confluent Cloud network you want to add the PrivateLink Endpoint to. The **Connection Type** of the network needs to be “PrivateLink Access”. 2. Click **Create endpoint** in the **Egress connections** tab. 3. Click the service you want to connect to, specifically, **ClickHouse**. Select **Other** if you do not see the specific service. 4. Follow the steps below to specify the following field values: * **SERVICE**: Name of service connecting to - ClickHouse. * **Endpoint Name**: Name of the PrivateLink Endpoint. * **PrivateLink service name**: The name of the PrivateLink service you retrieved in [Step 1. Obtain Endpoint Service name and DNS Name from ClickHouse](#cc-clickhouse-sink-eap-aws-service-dns-name). * **Create an endpoint with high availability**: Check the box if you wish to deploy an endpoint with High Availability. Endpoints deployed with high availability have network interfaces deployed in multiple availability zones. 5. Click **Create** to create the PrivateLink Endpoint. 6. If there are additional steps for the specific target service, follow the prompt to complete the tasks, and then click **Finish**. ### Enterprise cluster 1. In the **Network management** page or tab of the desired Confluent Cloud environment, click the **For serverless products** tab. 2. Click the gateway to which you want to add the PrivateLink Endpoint. 3. In the **Access points** tab, click **Add access point**. 4. Click the service you want to connect to. Select **Other** if you do not see the specific service. Specific services are listed based on the cloud provider for the gateway. 5. Follow the steps below to specify the following field values: * **Access point name**: Name of the PrivateLink Endpoint. * **Create an endpoint with high availability**: Check the box if you wish to deploy an endpoint with High Availability. Endpoints deployed with high availability have network interfaces deployed in multiple availability zones. * **PrivateLink service name**: The name of the PrivateLink service you retrieved in [Step 1. Obtain Endpoint Service name and DNS Name from ClickHouse](#cc-clickhouse-sink-eap-aws-service-dns-name). 6. Click **Create access point** to create the PrivateLink Endpoint. 7. If there are additional steps for the specific target service, follow the prompt to complete the tasks, and click **Finish**. ## Step 3. Add Endpoint ID to ClickHouse Cloud organization 1. Open the ClickHouse Cloud Console, and Copy the VPC endpoint ID from the **Egress connection** tab. ![image](connectors/cc-clickhouse-sink-connector/images-clickhouse-eap/clickhouse-vpc-endpoint-id.png) 2. Go to the **ClickHouse Console → Settings → Set up Private Endpoint**. Add the VPC endpoint ID retrieved in the previous step to the **Endpoint ID** field. This will allow requests from the Confluent cluster endpoint to access the ClickHouse service. ![image](connectors/cc-clickhouse-sink-connector/images-clickhouse-eap/clickhouse-add-endpoint.png) ## Step 4. Create a DNS record ### Dedicated cluster 1. When the PrivateLink Endpoint status transitions to “Ready”, in the **DNS** tab, click **Create record** on the associated PrivateLink Endpoint. ![image](connectors/cc-clickhouse-sink-connector/images-clickhouse-eap/clickhouse-create-dns-record.png) 2. Specify the following, and click **Save**. * **Access point**: Select the PrivateLink Endpoint you created above in [Step 2. Create an Egress PrivateLink Endpoint](#cc-clickhouse-sink-eap-aws-create-egress-endpoint). * **Domain**: Enter the domain name as DNS name we got from ClickHouse in [Step 1. Obtain Endpoint Service name and DNS Name from ClickHouse](#cc-clickhouse-sink-eap-aws-service-dns-name). ![image](connectors/cc-clickhouse-sink-connector/images-clickhouse-eap/clickhouse-dns-record.png) ### Enterprise cluster 1. In the **Network Management** tab of your environment, click the **For serverless products** tab, and click the Confluent Cloud gateway you want to add the DNS record to. 2. In the **DNS** tab, click **Create DNS record**. 3. Specify the following field values: * **Access point**: Select the PrivateLink Endpoint you created above in [Step 2. Create an Egress PrivateLink Endpoint](#cc-clickhouse-sink-eap-aws-create-egress-endpoint). * **Domain**: Enter the domain name as DNS name we got from ClickHouse in [Step 1. Obtain Endpoint Service name and DNS Name from ClickHouse](#cc-clickhouse-sink-eap-aws-service-dns-name). 4. Click **Save**. ## Step 5. Create the ClickHouse Sink connector 1. Specify the ClickHouse hostname as the DNS name fetched from ClickHouse in [Step 1. Obtain Endpoint Service name and DNS Name from ClickHouse](#cc-clickhouse-sink-eap-aws-service-dns-name). ![image](connectors/cc-clickhouse-sink-connector/images-clickhouse-eap/clickhouse-create-connector.png) 2. See the [ClickHouse Sink connector](cc-clickhouse-sink.md#cc-clickhouse-sink) documentation for the steps to create the sink connector Confluent Cloud.