# Egress PrivateLink Endpoints Setup Guide: DocumentDB on AWS for Confluent Cloud Use this guide to set up Egress PrivateLink Endpoints for Amazon DocumentDB on AWS and Confluent Cloud to enable fully managed connectors in Confluent Cloud using AWS PrivateLink. For fully managed connectors, Confluent Cloud supports two options for private egress to data systems in your AWS network: * **Egress PrivateLink Endpoints** route connector traffic through AWS PrivateLink. For more information, see [Step 6. Create an Egress PrivateLink Endpoint](#cc-aws-eap-documentdb-create-access-point). * **Private Network Interface (PNI)** routes connector traffic through Elastic Network Interfaces (ENIs) in your AWS account, without requiring PrivateLink infrastructure. PNI is available for Enterprise and Freight clusters. For setup steps, see [Use Private Network Interface on Confluent Cloud](../../networking/aws-pni.md#cloud-networking-pni-aws). Choose the option that best fits your cluster type and networking requirements. ## Prerequisites In Confluent Cloud, one of the following cluster types was set up with the specified network resource: * A Dedicated cluster with a Confluent Cloud network For the steps to create a Confluent Cloud network, see [Create a Confluent Cloud network](../../networking/ccloud-network/aws.md#ccn-config-aws). The Connection type of the network needs to be “PrivateLink Access”. * A Enterprise cluster with a network gateway For the steps to create a gateway, see [Create a gateway for outbound connectivity in Confluent Cloud](../../networking/aws-egress-privatelink-esku.md#aws-privatelink-egress-create-gateway-esku). * Clear/disable the [Enforce inbound rules on PrivateLink traffic](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-security-groups.html#update-security-settings) setting in AWS. ## Limitations The Egress PrivateLink Endpoint connects to a single IP address of the DocumentDB cluster. This means, if the IP address of the DocumentDB cluster changes, you must manually update the target group. This limitation does not apply to VPC peering connections, as they do not rely on a specific IP address. Consequently, if the DocumentDB cluster IP address changes, you must manually update the target group configuration. ## Step 1. Obtain instance details for DocumentDB 1. Go to the cluster page and note down the endpoint, the port, and the zone. 2. Obtain the private IP address using the following commands from the machine with access to the DocumentDB instance. * In Windows: `nslookup [documentdb-endpoint]` * In Linux and MacOS: `dig [documentdb-endpoint]` ## Step 2. Create a target group 1. In the AWS EC2 Dashboard, browse to **Load Balancing** → **Target Groups**. 2. Click **Create target group**. 3. Specify the group details: * **Choose a target type**: IP addresses * **Target group name**: The name of the target group * **Protocol**: TCP * **Port**: The port number used by the service (for example, 27017 for DocumentDB) * **VPC**: VPC where service is hosted * **Health check protocol**: TCP 4. Click **Next**. 5. Register the targets. 1. **Network**: Select the correct network. 2. **Enter an IPv4 address from a VPC subnet**: The private IP address of the instance captured [above](#cc-aws-eap-documentdb-instance-details). 3. **Ports**: check that the port number is correct. 6. Click **Include as pending below**. 7. Review targets. Ensure that proper private IP address, the correct port number, and the zone are listed for your service. 8. Click **Create target group**. ## Step 3. Create a load balancer 1. In the AWS EC2 Dashboard, browse to **Load Balancing** → **Load Balancers**. 2. Click **Create load balancer**. 3. Click **Create** to create a Network Load Balancer. 4. Specify the Basic configuration settings. 1. **Load balancer name**: The name of your load load balancer. 2. **Scheme**: Internal 3. **IP address type**: IPv4 5. Specify the Network mapping settings. 1. **VPC**: Select the VPC where you want to deploy the load balancer. 2. **Mappings**: Select the associated subnets. 3. **IPv4 address**: Leave the Private IPv4 address field unchanged. 6. In the Security groups section, ensure that the inbound rule for the port number is applied. 7. On the **Security** tab, disable the **Enforce inbound rules on PrivateLink traffic** setting. 8. Specify the Listeners and routing settings. 1. **Protocol**: TCP 2. **Port**: The port number of the service 3. **Forward to**: The target created in the previous Step 2 section. 9. Click **Create load balancer**. 10. Wait for the load balancer status to change to “Active”. ## Step 4. Create an endpoint service 1. In the AWS VPC Dashboard, browse to **Virtual private cloud** → **Endpoint services**. 2. Click **Create endpoint service**. 3. Specify the Endpoint service settings. 1. **Name**: Endpoint service name 2. **Load balancer type**: Network 4. In the **Available load balancers** section, select the network load balancer created in Step 3.  5. Specify the Additional settings. 1. **Require acceptance for endpoint**: Acceptance required 2. **Supported IP address types**: IPv4 6. Click **Create**. 7. Note the Service name of the created endpoint service.  ## Step 5. Allow Confluent principal 1. Obtain Confluent’s ARN in the Confluent Cloud Console. 1. Browse to your environment and its network, and select the associated PrivateLink network. 2. Click the **Egress PrivateLink Endpoints** tab.  2. In the AWS console, in the **Allow principals** tab of the created endpoint, click **Allow principals**. 3. Specify Confluent’s ARN.  ## Step 6. Create an Egress PrivateLink Endpoint ### Dedicated cluster 1. In the **Network management** page or tab of the desired Confluent Cloud environment, click the Confluent Cloud network you want to add the PrivateLink Endpoint to. The **Connection Type** of the network needs to be “PrivateLink Access”. 2. Click **Create endpoint** in the **Egress connections** tab. 3. Click the service you want to connect to. Select **Other** if you do not see the specific service. 4. Follow the guided steps to specify the field values, including: * **Name**: Name of the PrivateLink Endpoint. * **PrivateLink service name**: The name of the PrivateLink service. The service name is the one noted above, in the last step of the [Step 4. Create an endpoint service](#cc-aws-eap-documentdb-create-endpoint) section. * **Create an endpoint with high availability**: Check the box if you wish to deploy an endpoint with high availability. Endpoints deployed with high availability have network interfaces deployed in multiple availability zones. 5. Click **Create** to create the PrivateLink Endpoint. 6. If there are additional steps for the specific target service, follow the prompt to complete the tasks, and then click **Finish**. ### Enterprise cluster 1. In the **Network management** page or tab of the desired Confluent Cloud environment, click the **For serverless products** tab. 2. Click the gateway to which you want to add the PrivateLink Endpoint. 3. In the **Access points** tab, click **Add access point**. 4. Click the service you want to connect to. Select **Other** if you do not see the specific service. Specific services are listed based on the cloud provider for the gateway. 5. Follow the guided steps to specify the field values, including: * **Access point name**: Name of the PrivateLink Endpoint. * **Create an endpoint with high availability**: Check the box if you wish to deploy an endpoint with High Availability. Endpoints deployed with high availability have network interfaces deployed in multiple availability zones. * **PrivateLink service name**: The name of the PrivateLink service. The service name is the one noted above, in the last step of the [Step 4. Create an endpoint service](#cc-aws-eap-documentdb-create-endpoint) section. 6. Click **Create access point** to create the PrivateLink Endpoint. 7. If there are additional steps for the specific target service, follow the prompt to complete the tasks, and click **Finish**. ## Step 7. Accept the endpoint connection request When the PrivateLink Endpoint status changes to “Pending accept”, accept the connection request. 1. In the AWS console, in the **Endpoint connections** tab of the endpoint service, select the associated Endpoint ID. 2. Click **Actions**, and **Accept**. Type in `accept` and click **Accept**.  3. The status of the PrivateLink Endpoint will transition to “Ready” state. ## Step 8. Create the DNS record ### Dedicated cluster 1. When the PrivateLink Endpoint status transitions to “Ready”, click **Create DNS record** in the **DNS** tab, or click **Create Record** on the associated PrivateLink Endpoint tile. 2. Specify the following: * **Access point**: The Egress PrivateLink Endpoint you created in the [Step 6. Create an Egress PrivateLink Endpoint](#cc-aws-eap-documentdb-create-access-point) section. * **Domain**: The DocumentDB cluster endpoint (`example.cluster-example.us-west-2.docdb.amazonaws.com`). 3. Click **Save** to create the record. ### Enterprise cluster 1. In the **Network Management** tab of your environment, click the **For serverless products** tab, and click the Confluent Cloud gateway you want to add the DNS record to. 2. In the **DNS** tab, click **Create DNS record**. 3. Specify the following field values: * **Access point**: The Egress PrivateLink Endpoint you created in the [Step 6. Create an Egress PrivateLink Endpoint](#cc-aws-eap-documentdb-create-access-point) section. * **Domain**: The DocumentDB cluster endpoint (`example.cluster-example.us-west-2.docdb.amazonaws.com`). 4. Click **Save**. ## Step 9. Create the Connector 1. When the **DNS Record status** transitions to “Ready”, you can create the connector. 2. For the steps to create the connector, see connector-specific documentation that is listed for your specific connector in [Supported connectors](../overview.md#supported-connectors). ## Troubleshooting ### Issue: Connector is unable to connect to the target system even with the Egress PrivateLink Endpoint in the Ready state **Possible cause 1:** There could be a zonal mismatch. **Solution:** Enable cross-zone load balancing on your load balancer and try again. 1. In the EC2 Dashboard, browse to **Load Balancing** → **Load Balancers**, and click your load balancer. 2. Click **Actions**, and select **Edit load balancer attributes**. 3. In the Availability Zone routing configuration section, select **Enable cross-zone balancing**.  **Possible cause 2:** The Enforce inbound rules was not disabled in the security setting of the load balancer. **Solution:** Disable the Enforce inbound rules on PrivateLink traffic. In the AWS console, in the **Security settings** tab of the load balancer, clear the **Enforce inbound rules on PrivateLink traffic** setting. For information, see the [Enforce inbound rules on PrivateLink traffic](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-security-groups.html#update-security-settings) setting in AWS.