# Egress PrivateLink Endpoints Setup Guide: Self-Managed Services on AWS for Confluent Cloud Egress PrivateLink can be used to privately access resources residing within on-premises environments from Confluent Cloud. Use this guide to set up Egress PrivateLink Endpoints for self-managed services to enable fully managed connectors in Confluent Cloud using AWS PrivateLink. Refer to [AWS documentation](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#target-type) for step-by-step setup and associated limitations. For fully managed connectors, Confluent Cloud supports two options for private egress to data systems in your AWS network: * **Egress PrivateLink Endpoints** route connector traffic through AWS PrivateLink. For more information, see [Step 6. Create an Egress PrivateLink Endpoint](#cc-aws-eap-self-managed-create-access-point). * **Private Network Interface (PNI)** routes connector traffic through Elastic Network Interfaces (ENIs) in your AWS account, without requiring PrivateLink infrastructure. PNI is available for Enterprise and Freight clusters. For setup steps, see [Use Private Network Interface on Confluent Cloud](../../networking/aws-pni.md#cloud-networking-pni-aws). Choose the option that best fits your cluster type and networking requirements. ## Prerequisites In Confluent Cloud, one of the following cluster types was set up with the specified network resource: * A Dedicated cluster with a Confluent Cloud network For the steps to create a Confluent Cloud network, see [Create a Confluent Cloud network](../../networking/ccloud-network/aws.md#ccn-config-aws). The Connection type of the network needs to be “PrivateLink Access”. * A Enterprise cluster with a network gateway For the steps to create a gateway, see [Create a gateway for outbound connectivity in Confluent Cloud](../../networking/aws-egress-privatelink-esku.md#aws-privatelink-egress-create-gateway-esku). * Clear/disable the [Enforce inbound rules on PrivateLink traffic](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-security-groups.html#update-security-settings) setting in AWS. * If the service endpoint does not advertise availability zones that overlap with the Confluent Cloud’s endpoint, the cross-zone load balancing option should be enabled in AWS. For the steps to enable cross-zone load balancing, see [Issue: Connector is unable to connect to the target system even with the Egress PrivateLink Endpoint in the Ready state](#cc-aws-eap-self-managed-enable-cross-zone-load-balancing). ## Step 1. Identify the IP address(es) of the self-managed services Go to the instance page and note down the private IP address and the zone of the instance. The following are example entries for an EC2 instance.  ## Step 2. Create target groups If your self-managed service uses multiple ports, create a separate target group for each required port. Repeat the following steps for every port that your service requires. For example, Couchbase commonly requires the following ports: `8091`, `8092`, `8093`, `8094`, `8095`, `11210`. 1. In the AWS EC2 Dashboard, browse to **Load Balancing** → **Target Groups**. 2. Click **Create target group**. 3. Specify the group details: * **Choose a target type**: IP addresses * **Target group name**: The name of the target group * **Protocol**: TCP * **Port**: The port number for this specific service port * **VPC**: VPC where service is hosted * **Health check protocol**: TCP 4. Click **Next**. 5. Register the targets. 1. **Network**: Select **Other private IP address**. 2. **Enter a private IP address**: The private IP address of the instance captured above. 3. **Ports**: check that the port number is correct. 6. Click **Include as pending below**. 7. Review targets. Ensure that proper private IP address, the correct port number, and the zone are listed for your service. 8. Click **Create target group**. ## Step 3. Create a load balancer 1. In the AWS EC2 Dashboard, browse to **Load Balancing** → **Load Balancers**. 2. Click **Create load balancer**. 3. Click **Create** to create a Network Load Balancer. 4. Specify the Basic configuration settings. 1. **Load balancer name**: The name of your load load balancer. 2. **Scheme**: Internal 3. **IP address type**: IPv4 5. Specify the Network mapping settings. 1. **VPC**: Select the VPC where you want to deploy the load balancer. 2. **Mappings**: Select the associated subnets. 3. **IPv4 address**: Leave the Private IPv4 address field unchanged. 6. In the **Security groups** section, ensure that you have applied an inbound rule for the required port numbers. 7. Specify the Listeners and routing settings. Add a listener for each required service port and associate it with the corresponding target group created in [Step 2. Create target groups](#cc-aws-eap-self-managed-create-target-groups). 1. **Protocol**: TCP 2. **Port**: The port number of the service 3. **Forward to**: The target group created for this port in [Step 2. Create target groups](#cc-aws-eap-self-managed-create-target-groups). 8. Click **Create load balancer**. 9. Wait for the load balancer status to change to “Active”. ## Step 4. Create an endpoint service 1. In the AWS VPC Dashboard, browse to **Virtual private cloud** → **Endpoint services**. 2. Click **Create endpoint service**. 3. Specify the Endpoint service settings. 1. Name: name endpoint service 2. Load balancer type: Network 4. In the Specify Available load balancers section, select the network load balancer created in Step 3.  5. Specify the Additional settings. 1. **Require acceptance for endpoint**: Acceptance required 2. **Supported IP address types**: IPv4 6. Click **Create**. 7. Note the Service name of the created endpoint service.  ## Step 5. Allow Confluent principal 1. Obtain Confluent’s ARN in the Confluent Cloud Console. 1. Browse to your environment and its network, and select the associated PrivateLink network. 2. Click the **Egress PrivateLink Endpoints** tab.  2. In the AWS console, in the **Allow principals** tab of the created endpoint, click **Allow principals**. 3. Specify Confluent’s ARN.  ## Step 6. Create an Egress PrivateLink Endpoint ### Dedicated cluster 1. In the **Network management** page or tab of the desired Confluent Cloud environment, click the Confluent Cloud network you want to add the PrivateLink Endpoint to. The **Connection Type** of the network needs to be “PrivateLink Access”. 2. Click **Create endpoint** in the **Egress connections** tab. 3. Click the service you want to connect to. Select **Other** if you do not see the specific service. 4. Follow the guided steps to specify the field values, including: * **Name**: Name of the PrivateLink Endpoint. * **PrivateLink service name**: The name of the PrivateLink service. The service name is the one noted above, in the last step of the [Step 4. Create an endpoint service](#cc-aws-eap-self-managed-create-endpoint) section. * **Create an endpoint with high availability**: Check the box if you wish to deploy an endpoint with High Availability. Endpoints deployed with high availability have network interfaces deployed in multiple availability zones. 5. Click **Create** to create the PrivateLink Endpoint. 6. If there are additional steps for the specific target service, follow the prompt to complete the tasks, and then click **Finish**. ### Enterprise cluster 1. In the **Network management** page or tab of the desired Confluent Cloud environment, click the **For serverless products** tab. 2. Click the gateway to which you want to add the PrivateLink Endpoint. 3. In the **Access points** tab, click **Add access point**. 4. Click the service you want to connect to. Select **Other** if you do not see the specific service. Specific services are listed based on the cloud provider for the gateway. 5. Follow the guided steps to specify the field values, including: * **Access point name**: Name of the PrivateLink Endpoint. * **Create an endpoint with high availability**: Check the box if you wish to deploy an endpoint with High Availability. Endpoints deployed with high availability have network interfaces deployed in multiple availability zones. * **PrivateLink service name**: The name of the PrivateLink service. The service name is the one noted above, in the last step of the [Step 4. Create an endpoint service](#cc-aws-eap-self-managed-create-endpoint) section. 6. Click **Create access point** to create the PrivateLink Endpoint. 7. If there are additional steps for the specific target service, follow the prompt to complete the tasks, and click **Finish**. ## Step 7. Accept the endpoint connection request When the PrivateLink Endpoint status changes to “Pending accept”, accept the connection request. 1. In the AWS console, in the **Endpoint connections** tab of the endpoint service, select the associated Endpoint ID. 2. Click **Actions**, and **Accept**. Type in `accept` and click **Accept**.  3. The status of the PrivateLink Endpoint will transition to “Ready” state. ## Step 8. (Optional) Create the DNS record ### Dedicated cluster 1. When the PrivateLink Endpoint status transitions to “Ready”, click **Create DNS record** in the **DNS** tab, or click **Create Record** on the associated PrivateLink Endpoint tile. 2. Specify the following: * **Access point**: The Egress PrivateLink Endpoint you created in the [Step 6. Create an Egress PrivateLink Endpoint](#cc-aws-eap-self-managed-create-access-point) section. * **Domain**: Associated service endpoint (`..amazonaws.com`). 3. Click **Save** to create the record. ### Enterprise cluster 1. In the **Network Management** tab of your environment, click the **For serverless products** tab, and click the Confluent Cloud gateway you want to add the DNS record to. 2. In the **DNS** tab, click **Create DNS record**. 3. Specify the following field values: * **Access point**: The Egress PrivateLink Endpoint you created in the [Step 6. Create an Egress PrivateLink Endpoint](#cc-aws-eap-self-managed-create-access-point) section. * **Domain**: Associated service endpoint (`..amazonaws.com`). 4. Click **Save**. ## Step 9. Create the Connector 1. When the DNS Record status transitions to “Ready”, you can create the connector. 2. For the steps to create the connector, refer to the connector-specific documentation that is listed for your specific connector in [Supported connectors](../overview.md#supported-connectors). 3. If no DNS record was created, you will need to use the VPC endpoint DNS name for the connector endpoint configuration (i.e. hostname).  ## Troubleshooting ### Issue: Connector is unable to connect to the target system even with the Egress PrivateLink Endpoint in the Ready state **Possible cause:** There could be a zonal mismatch. **Solution:** Enable cross-zone load balancing on your load balancer and try again. 1. In the EC2 Dashboard, browse to **Load Balancing** → **Load Balancers**, and click your load balancer. 2. Click **Actions**, and select **Edit load balancer attributes**. 3. In Availability Zone routing configuration, select **Enable cross-zone balancing**.