# Egress PrivateLink Endpoints Setup Guide: First-Party Services on AWS for Confluent Cloud Use this guide to set up Egress PrivateLink Endpoints for the AWS first-party services on AWS and Confluent Cloud to enable fully managed connectors in Confluent Cloud using AWS PrivateLink. For fully managed connectors, Confluent Cloud supports two options for private egress to data systems in your AWS network: * **Egress PrivateLink Endpoints** route connector traffic through AWS PrivateLink. For more information, see [Step 1. Create an Egress PrivateLink Endpoint](#cc-aws-eap-1st-party-access-point). * **Private Network Interface (PNI)** routes connector traffic through Elastic Network Interfaces (ENIs) in your AWS account, without requiring PrivateLink infrastructure. PNI is available for Enterprise and Freight clusters. For setup steps, see [Use Private Network Interface on Confluent Cloud](../../networking/aws-pni.md#cloud-networking-pni-aws). Choose the option that best fits your cluster type and networking requirements. ## Prerequisites In Confluent Cloud, one of the following cluster types was set up with the specified network resource: * A Dedicated cluster with a Confluent Cloud network For the steps to create a Confluent Cloud network, see [Create a Confluent Cloud network](../../networking/ccloud-network/aws.md#ccn-config-aws). The Connection type of the network needs to be “PrivateLink Access”. * A Enterprise cluster with a network gateway For the steps to create a gateway, see [Create a gateway for outbound connectivity in Confluent Cloud](../../networking/aws-egress-privatelink-esku.md#aws-privatelink-egress-create-gateway-esku). ## Step 1. Create an Egress PrivateLink Endpoint Confluent Cloud Egress PrivateLink Endpoints are [AWS interface VPC Endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html) used to connect to AWS PrivateLink Services. ### Dedicated cluster 1. In the **Network management** page or tab of the desired Confluent Cloud environment, click the Confluent Cloud network you want to add the PrivateLink Endpoint to. The **Connection Type** of the network needs to be “PrivateLink Access”. 2. Click **Create endpoint** in the **Egress connections** tab. 3. Click the service you want to connect to. Select **Other** if you do not see the specific service. 4. Follow the guided steps to specify the field values, including: * **Name**: Name of the PrivateLink Endpoint. * **PrivateLink service name**: The name of the PrivateLink service. The applicable service name can be retrieved from the [AWS Services Privatelink Support page](https://docs.aws.amazon.com/vpc/latest/privatelink/aws-services-privatelink-support.html), for example, `com.amazonaws..`. * **Create an endpoint with high availability**: Check the box if you wish to deploy an endpoint with High Availability. Endpoints deployed with high availability have network interfaces deployed in multiple availability zones. 5. Click **Create** to create the PrivateLink Endpoint. 6. If there are additional steps for the specific target service, follow the prompt to complete the tasks, and then click **Finish**. ### Enterprise cluster 1. In the **Network management** page or tab of the desired Confluent Cloud environment, click the **For serverless products** tab. 2. Click the gateway to which you want to add the PrivateLink Endpoint. 3. In the **Access points** tab, click **Add access point**. 4. Click the service you want to connect to. Select **Other** if you do not see the specific service. Specific services are listed based on the cloud provider for the gateway. 5. Follow the guided steps to specify the field values, including: * **Access point name**: Name of the PrivateLink Endpoint. * **Create an endpoint with high availability**: Check the box if you wish to deploy an endpoint with High Availability. Endpoints deployed with high availability have network interfaces deployed in multiple availability zones. * **PrivateLink service name**: The name of the PrivateLink service. The applicable service name can be retrieved from the [AWS Services Privatelink Support page](https://docs.aws.amazon.com/vpc/latest/privatelink/aws-services-privatelink-support.html), for example, `com.amazonaws..`. 6. Click **Create access point** to create the PrivateLink Endpoint. 7. If there are additional steps for the specific target service, follow the prompt to complete the tasks, and click **Finish**. ## Step 2. Create the DNS record ### Dedicated cluster 1. When the PrivateLink Endpoint status transitions to “Ready”, click **Create DNS record** in the **Egress DNS** tab, or click **Create Record** on the associated PrivateLink Endpoint tile. 2. Specify the following: * **Access point**: The Egress PrivateLink Endpoint you created in the [Step 1](#cc-aws-eap-1st-party-access-point) section above. * **Domain**: Associated service endpoint (`..amazonaws.com`). Links to AWS Service endpoints can be found on [AWS Service Information](https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html). 3. Click **Save** to create the record. ### Enterprise cluster 1. In the **Network Management** tab of your environment, click the **For serverless products** tab, and click the Confluent Cloud gateway you want to add the DNS record to. 2. In the **DNS** tab, click **Create DNS record**. 3. Specify the following field values: * **Access point**: The Egress PrivateLink Endpoint you created in the [Step 1](#cc-aws-eap-1st-party-access-point) section above. * **Domain**: Associated service endpoint (`..amazonaws.com`). Links to AWS Service endpoints can be found on [AWS Service Information](https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html). 4. Click **Save**. ## Step 3. Create the Connector 1. When the DNS Record status transitions to “Ready”, you can create the connector. 2. For the steps to create the connector, refer to the connector-specific documentation that is listed for your specific connector in [Supported connectors](../overview.md#supported-connectors).