# Egress PrivateLink Endpoint Setup: Neo4j on AWS for Confluent Cloud The Neo4j Sink connector for Confluent Cloud supports AWS PrivateLink connectivity through Egress PrivateLink Endpoints. Use this guide to configure the connector and set up the required endpoints. ## Prerequisites The following is a list of prerequisites for configuring the Neo4j Sink connector with an Egress PrivateLink Endpoint: * In Confluent Cloud, one of the following cluster types was set up with the specified network resource: * A Dedicated cluster with a Confluent Cloud network For the steps to create a Confluent Cloud network, see [Create a Confluent Cloud network](../../networking/ccloud-network/aws.md#ccn-config-aws). The Connection type of the network needs to be “PrivateLink Access”. * A Enterprise cluster with a network gateway. For the steps to create a gateway, see [Create a gateway for outbound connectivity in Confluent Cloud](../../networking/aws-egress-privatelink-esku.md#aws-privatelink-egress-create-gateway-esku). * Neo4j Aura DB running in the AWS cloud. * Confluent Cloud network (Dedicated or Serverless Egress Gateway) setup running within the same region and cloud as the Neo4j Aura DB. ## Step 1. Add Private Endpoint in Neo4j Aura In the Neo4j Aura console, create a private endpoint for your Dedicated or Enterprise Neo4j Aura DB: 1. Select a project to add an AWS PrivateLink connection. 2. In the **Security & Networking** section, go to **Settings** → **Private Endpoints**. 3. Click **New network access configuration**. ![Add a New Network Access Configuration in Neo4j Aura](connectors/cc-neo4j-sink/images-aws/aws-network-access-configuration.png) 4. Select the instance type and AWS region (ensure this matches your Confluent cluster region). 5. Click **Enable PrivateLink** to add the PrivateLink Endpoint ![Add a Neo4j Aura Private Endpoint](connectors/cc-neo4j-sink/images-aws/aws-enable-PrivateLink.png) 6. Make a note of the **Endpoint service name** for creating a Confluent Cloud Egress PrivateLink Endpoint in [Step 2. Create an Egress PrivateLink Endpoint in Confluent Cloud](#cc-neo4j-sink-eap-aws-access-endpoint). ![Fetch a PrivateLink Service Name](connectors/cc-neo4j-sink/images-aws/aws-fetch-PrivateLink-Service-Name.png) 7. You can close the workflow for now. You will complete the rest of the configuration after you create a VPC endpoint ID in Confluent Cloud. ## Step 2. Create an Egress PrivateLink Endpoint in Confluent Cloud ### Dedicated cluster 1. In the **Network management** page or tab of the desired Confluent Cloud environment, click the Confluent Cloud network you want to add the PrivateLink Endpoint to. The **Connection Type** of the network needs to be “PrivateLink Access”. 2. Click **Create endpoint** in the **Egress connections** tab. 3. Click the service you want to connect to, specifically, **Neo4j**. Select **Other** if you do not see the specific service. 4. Follow the guided steps to specify the field values, including: * **Service**: Name of the service connecting to. For example, Neo4j. * **Endpoint name**: Name of the PrivateLink Endpoint. * **PrivateLink service name**: The name of the PrivateLink service you retrieved in [Step 1. Add Private Endpoint in Neo4j Aura](#cc-neo4j-eap-aws-create-endpoint). * **Create an endpoint with high availability**: Check the box if you wish to deploy an endpoint with High Availability. Endpoints deployed with high availability have network interfaces deployed in multiple availability zones. 5. Click **Create** to create the PrivateLink Endpoint. 6. If there are additional steps for the specific target service, follow the prompt to complete the tasks, and then click **Finish**. ### Enterprise cluster 1. In the **Network management** page or tab of the desired Confluent Cloud environment, click the **For serverless products** tab. 2. Click the gateway to which you want to add the PrivateLink Endpoint. 3. In the **Access points** tab, click **Add access point**. 4. Click the service you want to connect to. Select **Other** if you do not see the specific service. Specific services are listed based on the cloud provider for the gateway. 5. Follow the guided steps to specify the field values, including: * **Access point name**: Name of the PrivateLink Endpoint. * **Create an endpoint with high availability**: Check the box if you wish to deploy an endpoint with High Availability. Endpoints deployed with high availability have network interfaces deployed in multiple availability zones. * **PrivateLink service name**: The name of the PrivateLink service you retrieved in [Step 1. Add Private Endpoint in Neo4j Aura](#cc-neo4j-eap-aws-create-endpoint). 6. Click **Create access point** to create the PrivateLink Endpoint. 7. If there are additional steps for the specific target service, follow the prompt to complete the tasks, and click **Finish**. ## Step 3. Configure the Neo4j Aura private endpoint in Neo4j Aura 1. In the Neo4j Aura console, go to previously created Aura private endpoint screen. An endpoint connection request will appear in Neo4j Aura matching the VPC connection ID created in Step 2. ![Aura Endpoint Connection Request](connectors/cc-neo4j-sink/images-aws/aws-endpoint-connection-request.png) 2. Enter the endpoint ID and click **Accept** to complete the AWS PrivateLink connection setup. Wait for the status to change from pending to accepted. ![Configure an Aura Endpoint Connection Request](connectors/cc-neo4j-sink/images-aws/aws-Accept-Aura-Endpoint-Connection-Request.png) 3. Click **Disable public traffic** and save the change. This changes your instance’s connection string to a protected one that the internet cannot access. ![Disable a Public Traffic](connectors/cc-neo4j-sink/images-aws/aws-disable-public-traffic.png) 4. Make a note of the Private Endpoint DNS (for example, `production-orch-1149.neo4j.io`) which will be required for creating a DNS record in the next step. ## Step 4. Create a DNS record in Confluent Cloud ### Dedicated cluster 1. When the PrivateLink Endpoint status transitions to “Ready”, in the **DNS** tab, click **Create record** on the associated PrivateLink Endpoint. ![Create a DNS record](connectors/cc-neo4j-sink/images-aws/aws-create-dns-record.png) 2. Specify the following, and click **Save**. * **Access point**: Select the PrivateLink Endpoint you created above in [Step 2. Create an Egress PrivateLink Endpoint in Confluent Cloud](#cc-neo4j-sink-eap-aws-access-endpoint). * **Domain**: Enter the domain name you created above in [Step 3. Configure the Neo4j Aura private endpoint in Neo4j Aura](#cc-neo4j-eap-aws-configure-endpoint). ### Enterprise cluster 1. In the **Network Management** tab of your environment, click the **For serverless products** tab, and click the Confluent Cloud gateway you want to add the DNS record to. 2. In the **DNS** tab, click **Create DNS record**. 3. Specify the following field values: * **Access point**: Select the PrivateLink Endpoint you created above in [Step 2. Create an Egress PrivateLink Endpoint in Confluent Cloud](#cc-neo4j-sink-eap-aws-access-endpoint). * **Domain**: Enter the domain name you created above in [Step 3. Configure the Neo4j Aura private endpoint in Neo4j Aura](#cc-neo4j-eap-aws-configure-endpoint). 4. Click **Save**. ## Step 5. Create the Neo4j Sink connector 1. Specify the authentication details for Neo4j. For the **Neo4j URI**, the DNS name you fetched in [Step 3. Configure the Neo4j Aura private endpoint in Neo4j Aura](#cc-neo4j-eap-aws-configure-endpoint), prepending it with the required prefix, `neo4j+s://`. ![Create a Neo4j Sink Connector](connectors/cc-neo4j-sink/images-aws/aws-add-neo4j-sink-connector.png) 2. Follow the steps to create the [sink connector](cc-neo4j-sink.md#cc-neo4j-sink) in Confluent Cloud.