# Egress Private Link Endpoints Setup Guide: First-Party Services on Azure for Confluent Cloud Use this guide to set up Egress Private Link Endpoints for the Azure first-party services on Azure and Confluent Cloud to enable fully managed connectors in Confluent Cloud using Azure Private Link. ## Prerequisites In Confluent Cloud, one of the following cluster types was set up with the specified network resource: * A Dedicated cluster with a Confluent Cloud network For the steps to create a Confluent Cloud network, see [Create a Confluent Cloud network](../../networking/ccloud-network/azure.md#ccn-config-azure). The Connection type of the network needs to be “Private Link Access”. * A Enterprise cluster with a network gateway For the steps to create a gateway, see [Create a gateway for outbound connectivity in Confluent Cloud](../../networking/azure-egress-privatelink-esku.md#azure-privatelink-egress-create-gateway-esku). ## Step 1. Retrieve the Resource ID 1. In the Azure portal, go to your service’s overview section, and click **Json View**. ![image](connectors/networking/images/azure-1st-party-json.png) 2. Copy the Resource ID which is required when you create the Egress Private Link Endpoint in Confluent Cloud. ![image](connectors/networking/images/azure-1st-party-resourceid.png) ## Step 2. Create an Egress Private Link Endpoint Confluent Cloud Egress Private Link Endpoints are [Azure Private Endpoints](https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview) used to connect to Azure Private Link Services. ### Dedicated cluster 1. In the **Network management** page or tab of the desired Confluent Cloud environment, click the Confluent Cloud network you want to add the Private Link Endpoint to. The **Connection Type** of the network needs to be “Private Link Access”. 2. Click **Create endpoint** in the **Egress connections** tab. 3. Click the service you want to connect to. Select **Other** if you do not see the specific service. 4. Follow the guided steps to specify the field values, including: * **Service**: Specify the service that you want Confluent Cloud to connect to. For example, Azure Key Vault. * **Name**: The name of the Private Link Endpoint. * **Resource ID**: The resource ID of the Private Link service. The Resource ID is the one noted down above, in the last step of the Step 1 section. Note that the resource alias is not supported. * **Sub-resource name**: The sub-resource name for the specific Azure service. The applicable sub-resource name can be retrieved in [Azure Private-link resource](https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview#private-link-resource). For example: | Target System | Sub-resource Name | |-------------------------------|-----------------------------------------| | Blob | blob | | Data Lake Storage Gen2 | dfs | | Cosmos DB (Dependent on type) | Sql, MongoDB, Cassandra, Gremlin, Table | | Azure Key Vault | vault | 5. Click **Create** to create the Private Link Endpoint. 6. If there are additional steps for the specific target service, follow the prompt to complete the tasks, and then click **Finish**. ### Enterprise cluster 1. In the **Network management** page or tab of the desired Confluent Cloud environment, click the **For serverless products** tab. 2. Click the gateway to which you want to add the Private Link Endpoint. 3. In the **Access points** tab, click **Add access point**. 4. Select the service you want to connect to. Specific services are listed based on the cloud provider for the gateway. 5. Follow the guided steps to specify the field values, including: * **Access point name**: The name of the Private Link Endpoint. * **Resource ID**: The resource ID of the Private Link service. The Resource ID is the one noted down above, in the last step of the Step 1 section. Note that the resource alias is not supported. * **Sub-resource name**: The sub-resource name for the specific Azure service. The applicable sub-resource name can be retrieved in [Azure Private-link resource](https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview#private-link-resource). For example: | Target System | Sub-resource Name | |-------------------------------|-----------------------------------------| | Blob | blob | | Data Lake Storage Gen2 | dfs | | Cosmos DB (Dependent on type) | Sql, MongoDB, Cassandra, Gremlin, Table | 6. Click **Create access point** to create the Private Link Endpoint. 7. If there are additional steps for the specific target service, follow the prompt to complete the tasks, and then click **Finish**. ## Step 3. Accept the connection request When the Private Link Endpoint status becomes “Pending Accept” in the Azure portal, go to [Pending Connections](https://portal.azure.com/#view/Microsoft_Azure_Network/PrivateLinkCenterBlade/~/pendingconnections) and approve the associated connection request. Confirm this is the correct connection by checking the **Description** column which will provide the associated Confluent Cloud gateway and environment ID. ![image](connectors/networking/images/azure-1st-party-accept-connection.png) ## Step 4. Create the DNS record ### Dedicated cluster 1. When the Private Link Endpoint status transitions to “Ready”, in the **Egress DNS** tab, click **Create DNS record**, or click **Create Record** on the associated Private Link Endpoint tile. 2. Specify the following: * **Access point**: The Egress Private Link Endpoint ID you created in [create an Egress Private Link Endpoint](#cc-azure-eap-1st-party-create-access-point). * **Domain**: The associated service endpoint. For example, for Azure SQL Server, it is in the pattern, `.database.windows.net`. For Azure Key Vault, it is in the pattern `.vault.azure.net`. For multiple domains, for example with Cosmo DB, you can specify a comma-separated list of the domain values. Get the domain values from Azure. 3. Click **Save**. ### Enterprise cluster 1. In the **Network Management** tab of your environment, click the Confluent Cloud gateway you want to add the DNS record to. 2. In the **DNS** tab, click **Create DNS record**. 3. Specify the following field values. * **Egress Private Link Endpoint**: The Access Point ID you created in [create an Egress Private Link Endpoint](#cc-azure-eap-1st-party-create-access-point). * **Domain**: The associated service endpoint. For example, for Azure SQL Server, it is in the pattern, `.database.windows.net`. For multiple domains, for example, with Cosmo DB, you can specify a comma-separated list of the domain values. Get the domain values from Azure. 4. Click **Save**. ## Step 5. Create the connector 1. When the DNS Record status transitions to “Ready”, you can create the connector. 2. For the steps to create the connector, refer to the connector-specific documentation that is listed for your specific connector in [Supported connectors](../overview.md#supported-connectors).