# Enable Private Networking with Confluent Cloud for Apache Flink *Private networking* for Confluent Cloud for Apache Flink® keeps Flink SQL statement traffic inside your private network by routing it through AWS PrivateLink, a Confluent Cloud network (CCN), or an egress private endpoint, rather than over the public internet. Choose the option below that matches your existing connectivity to Confluent Cloud. - [PrivateLink Gateway](../concepts/flink-private-networking.md#flink-sql-private-networking-connectivity-options-pla): Works with any type of cluster and is available on AWS, Azure, and Google Cloud. For more information, see [Supported Cloud Regions](../reference/overview.md#flink-cloud-regions). #### NOTE As of February 12th, 2026, the ingress PrivateLink Gateway resource replaces the PrivateLink Attachment (PLATT) resource. Existing PLATT resources continue to function, but you should update to use gateways. - Existing or new [Confluent Cloud network (CCN)](../concepts/flink-private-networking.md#flink-sql-private-networking-connectivity-options-ccn): Available on AWS and Azure. To create a new Confluent Cloud network, follow the steps in [Create Confluent Cloud Network on AWS](../../networking/ccloud-network/aws.md#create-ccloud-network-aws). - [Egress PrivateLink endpoints](../concepts/flink-private-networking.md#flink-sql-private-networking-connectivity-options-egress): Available on AWS and Azure. For more information, see [Private Networking with Confluent Cloud for Apache Flink](../concepts/flink-private-networking.md#flink-sql-private-networking). #### IMPORTANT If you use [Client-Side Field Level Encryption](../../security/encrypt/csfle/overview.md#csfle-overview) or [Client-Side Payload Encryption](../../security/encrypt/cspe.md#use-client-side-payload-encryption) with transparent decryption, Flink requires network connectivity to your Key Management Service to retrieve encryption keys. Ensure your private network configuration allows Flink to reach your KMS endpoints. For more information about transparent decryption, see [Process Encrypted Data with Confluent Cloud for Apache Flink](../../security/encrypt/csfle/flink-integration.md#csfle-flink-integration). - [Enable private networking with PrivateLink Gateway](#flink-sql-enable-private-networking-pla) - [Enable private networking with Confluent Cloud network (CCN) for Azure and AWS](#flink-sql-enable-private-networking-ccn) - [Enable private networking with Egress PrivateLink Endpoints](#flink-sql-enable-private-networking-egress)
## Enable private networking with Confluent Cloud network (CCN) for Azure and AWS If you already have a [Confluent Cloud Network (CCN)](../../networking/ccloud-network/aws.md#create-ccloud-network-aws) created and configured, which is usually the case when you have any Dedicated cluster, you can use this network directly to connect to Flink. Configuring Flink requires little to no setup, because you can reuse connectivity to existing Private Endpoints, Peering, or Transit Gateway. To access Flink from your local client, follow these steps. ### Prerequisites - Access to Confluent Cloud. - The [OrganizationAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#organizationadmin-role), [EnvironmentAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#environmentadmin-role), or [NetworkAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#networkadmin-role) role to enable Flink private networking for an environment. ### Configure DNS resolution 1. Ensure your VPC is configured to route your unique Flink endpoint to Confluent Cloud. 2. Have a client that is running within the VPC, or a proxy that reroutes your client to the VPC. For more information, see [Use the Confluent Cloud Console with Private Networking](../../networking/ccloud-console-access.md#ccloud-console-access-networking). If you already configured 1 and 2 for Apache Kafka®, you might not need any changes. - For public DNS resolution with endpoints that resemble `flink-...private.confluent.cloud`: if your local machine was already configured to access Kafka, no additional setup is necessary. - **With PrivateLink only:** For private DNS resolution with endpoints that resemble `flink....private.confluent.cloud`, if routing is using `*....private.confluent.cloud`, no additional setup is necessary, but if your routing is using a more specific URL, you must add the Flink endpoint to your routing rules. If you use a reverse proxy with a custom route added to your local host file, you must add the Flink endpoint to your host file. Additionally, routing to `flinkpls...confluent.cloud` is necessary to enable auto-completion and error highlighting in the Flink SQL shell and Confluent Cloud Console. ## Enable private networking with PrivateLink Gateway Private networking with [PrivateLink Gateway](../concepts/flink-private-networking.md#flink-sql-private-networking-connectivity-options-pla) works with any type of cluster and is available on AWS, Azure, and Google Cloud. ### Prerequisites - Access to Confluent Cloud. - The [OrganizationAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#organizationadmin-role), [EnvironmentAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#environmentadmin-role), or [NetworkAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#networkadmin-role) role to enable Flink private networking for an environment. - A VPC in AWS, a VNet in Azure, or a VPC in Google Cloud. ### Overview In this walkthrough, you perform the following steps. 1. [Set up a gateway and access point](#flink-sql-enable-private-networking-create-pla) 1. Create a PrivateLink Gateway. 2. Create a private endpoint. - For AWS, create a VPC Interface Endpoint to the PrivateLink Gateway. - For Azure, create a private endpoint that’s associated with the PrivateLink Gateway. - For Google Cloud, create a private endpoint that’s associated with the PrivateLink Gateway. 3. Create a PrivateLink Access Point. 4. Set up DNS resolution. 2. [Connect to the private network](#flink-sql-enable-private-networking-connect-to-network): If your client is not in the VPC or VNet, enable the Cloud Console or Confluent CLI to connect to your private network. After you complete the previous steps, you can use Flink over your private network from the Confluent Cloud Console or Confluent CLI. The experience is the same as with public networking. ### Step 1: Set up a PrivateLink Gateway and PrivateLink Access Point In AWS, Azure, or Google Cloud, follow these steps to create a PrivateLink Gateway, a private endpoint, a PrivateLink Access Point, and set up a DNS resolution. ### AWS 1. In Confluent Cloud, create a [gateway](../../networking/aws-platt.md#privatelinkattachment-create). On the **Network management** page for your environment, add a PrivateLink gateway configuration. Note the **PrivateLink Service ID** it generates. 2. In AWS, create a [VPC Interface Endpoint to the gateway service](../../networking/aws-platt.md#privatelinkattachment-endpoint-create). Create the endpoint using the **PrivateLink Service ID** from the previous step. 3. In Confluent Cloud, create a [access point](../../networking/aws-platt.md#privatelinkattachment-connection-create). Register the ID of your VPC endpoint with the gateway to complete the connection. 4. Set up a [DNS resolution](../../networking/aws-platt.md#privatelinkattachment-dns). Set the access point’s DNS domain to your VPC endpoint, typically using AWS Route 53. ### Azure 1. In Confluent Cloud, create a [gateway](../../networking/azure-platt.md#privatelinkattachment-create-az). On the **Network management** page for your environment, add a PrivateLink gateway configuration. Note the **Private Link Service ID** or **Private Link Service Alias** it generates. 2. In Azure, create a [private endpoint](../../networking/azure-platt.md#privatelinkattachment-endpoint-create-az). Create the endpoint using the **Private Link Service ID** or **Private Link Service Alias** from the previous step. 3. In Confluent Cloud, create a [access point](../../networking/azure-platt.md#privatelinkattachment-connection-create-az). Register the ID of your private endpoint with the gateway to complete the connection. 4. Set up a [DNS resolution](../../networking/azure-platt.md#privatelinkattachment-dns-az). Set the access point’s DNS domain to your private endpoint. ### Google Cloud 1. In Confluent Cloud, create a [gateway](../../networking/gcp-platt.md#privatelinkattachment-create-gc). Gateways are powered by Private Service Connect. 2. In Google Cloud, [create a Private Service Connect endpoint](../../networking/gcp-platt.md#private-service-connect-gc-create-endpoint-esku) to the service attachment URI you get in Step 1. If you use the Confluent Cloud Console for configuration, the next step merges this step in and presents it as the first and second steps in access point creation. 3. In Confluent Cloud, [create an access point](../../networking/gcp-platt.md#private-service-connect-gc-create-connection-esku) for the Private Service Connect endpoint you created. A PrivateLink Access Point is required for each Private Service Connect endpoint. 4. Set up a [DNS resolution](../../networking/gcp-platt.md#private-service-connect-gc-dns-records-esku). Set the access point’s DNS domain to your Private Service Connect endpoint.
### Step 2: Connect to the network with Cloud Console or Confluent CLI If your client is not in the VPC or VNet, enable the Confluent Cloud Console or Confluent CLI to connect to your private network. If you don’t connect from a machine in the VPC or VNet, you see the following error. ![Private networking error when not connecting from a machine in the VPC or VNet](flink/images/flink-private-networking-error-state.png) To connect to Confluent Cloud with your PrivateLink Gateway, see [Use Confluent Cloud with Private Networking](../../networking/ccloud-console-access.md#ccloud-console-access-networking). One way to connect is to set up a [reverse proxy](../../networking/ccloud-console-access.md#proxied-access). 1. Create an EC2 instance. 2. Connect to the instance with SSH. 3. Install NGINX. 4. Configure Routing Table. 5. Set up DNS resolution: point to the Flink regional endpoints you use, as described in Step 6 of [Configure a proxy](../../networking/ccloud-console-access.md#proxied-access). ```none ``` `` resembles `flink...private.confluent.cloud`, for example: `flink.us-east-2.aws.private.confluent.cloud`. Find the DNS part of the PrivateLink Gateway by navigating to your environment’s **Network management** page and finding the **DNS domain** setting. ![DNS domain on the Network Management for Flink private networking](flink/images/flink-private-networking-dns-domain.png) You can find the full list of supported Flink regions by using the [Regions endpoint API](flink-rest-api.md#flink-rest-api-list-regions). After you set up networking in Cloud Console, the interface uses the correct endpoint automatically, either public or private, based on the presence of a PrivateLink Gateway. If the connection is private, access to the Flink private network works transparently. ## Enable private networking with Egress PrivateLink Endpoints Egress PrivateLink Endpoints enable outbound private connectivity from Confluent Cloud to external systems, such as [external tables](../concepts/external-tables.md#flink-external-tables), on AWS and Azure. ### AWS Here is an overview of how to set up an Egress PrivateLink Endpoint on AWS: 1. [Create a gateway for outbound connectivity in Confluent Cloud](../../networking/aws-egress-privatelink-esku.md#aws-privatelink-egress-create-gateway-esku). 2. [Obtain the AWS PrivateLink Service name](../../networking/aws-egress-privatelink-esku.md#aws-privatelink-egress-obtain-service-name-esku). For certain target services, you can retrieve the service name as part of the guided workflow while creating an Egress PrivateLink Endpoint in the next step. 3. [Create an Egress PrivateLink Endpoint in Confluent Cloud](../../networking/aws-egress-privatelink-esku.md#aws-privatelink-egress-create-access-point-esku). 4. [[Optional] Create private DNS records for use with AWS VPC endpoints](../../networking/aws-egress-privatelink-esku.md#aws-privatelink-egress-dns-records-esku). For detailed steps, see [Use AWS Egress PrivateLink Endpoints for Serverless Products](../../networking/aws-egress-privatelink-esku.md#cloud-networking-privatelink-aws-egress-esku). ### Azure Here is an overview of how to set up an Egress Private Link Endpoint on Azure: 1. [Create a gateway for outbound connectivity in Confluent Cloud](../../networking/azure-egress-privatelink-esku.md#azure-privatelink-egress-create-gateway-esku). 2. [Obtain the Azure Private Link service resource ID](../../networking/azure-egress-privatelink-esku.md#azure-private-link-egress-obtain-service-name-esku). For certain target services, you can retrieve the service resource ID as part of the guided workflow while creating an Egress Private Link Endpoint in the next step. 3. [Create an Egress Private Link Endpoint in Confluent Cloud](../../networking/azure-egress-privatelink-esku.md#azure-private-link-egress-create-access-point-esku). 4. [[Optional] Create private DNS records for use with Azure private endpoints](../../networking/azure-egress-privatelink-esku.md#azure-private-link-egress-dns-records-esku). For detailed steps, see [Use Azure Egress Private Link Endpoints for Serverless Products](../../networking/azure-egress-privatelink-esku.md#cloud-networking-privatelink-azure-egress-esku). ## Related content - [Use Confluent Cloud with Private Networking](../../networking/ccloud-console-access.md#ccloud-console-access-networking) - [Security Controls in Confluent Cloud for Apache Flink](../concepts/security-controls.md#flink-security-controls) - [Flink Compute Pools](../concepts/compute-pools.md#flink-sql-compute-pools) - [Billing on Confluent Cloud for Apache Flink](../concepts/flink-billing.md#flink-sql-billing) #### NOTE This website includes content developed at the [Apache Software Foundation](https://www.apache.org/) under the terms of the [Apache License v2](https://www.apache.org/licenses/LICENSE-2.0.html).