Use AWS PrivateLink for Serverless Products on Confluent Cloud

From your AWS virtual private cloud (VPC), you can use AWS PrivateLink to privately access serverless Confluent Cloud products. These products include Enterprise Kafka clusters, Schema Registry clusters, and Confluent Cloud for Apache Flink®. When you use AWS PrivateLink, your Confluent resources are only accessible from private endpoints in AWS that connect to your Confluent Cloud environment. To enable PrivateLink connectivity, you create the following private networking resources in your Confluent Cloud environment:

Ingress PrivateLink Gateway

A reservation to establish a PrivateLink connection from your VPC to regional services in a Confluent Cloud environment.

Ingress PrivateLink Access Point

A registration of a VPC interface endpoint that’s allowed to connect to a Confluent Cloud environment. A PrivateLink Access Point belongs to a specific PrivateLink Gateway.

These resources are regional and can be accessed from any availability zones.

Note

As of February 12th, 2026, the PrivateLink Attachment (PLATT) resource is replaced by the ingress PrivateLink Gateway resource. A gateway provides the same functionality as a PLATT, but it provides unique fully qualified domain names (FQDNs) for each PrivateLink connection. With these FQDNs, your applications can more granularly route traffic from your AWS VPC to the services in your Confluent Cloud environment.

Existing PLATT resources will continue to function, but you won’t be able to provision new ones following a future release. We recommended that you update your applications to use to use gateways.

You can use the Confluent Cloud Console, the Confluent REST API, the Confluent CLI, or Terraform to establish PrivateLink connectivity with the serverless products in your Confluent Cloud environment.

Requirements and considerations

• For the supported regions, see Cloud Providers and Regions for Confluent Cloud.

• Ingress PrivateLink Gateway resources don’t support PrivateLink connections to:

  • Different cloud regions.

  • Confluent Cloud resources in different environments.

• Confluent Cloud Console components, such as topic management and Flink workspaces, may require additional configuration because they use private endpoints that aren’t accessible from the public internet. For information about using Flink with AWS PrivateLink, see Private Networking with Confluent Cloud for Apache Flink. To use all features of the Confluent Cloud Console with AWS PrivateLink, see Use the Confluent Cloud Console with Private Networking.

Step 1: Create an ingress PrivateLink Gateway

Create an ingress PrivateLink Gateway to enable PrivateLink connections to the Enterprise Kafka clusters, Schema Registry clusters, and the Flink service in an environment for a specific cloud region.

Confluent Cloud Console

1. In the Confluent Cloud Console, click Environments in the navigation menu.

2. On the Environments page, do one of the following:

   • If you already have the environment where you want to create the gateway, select it.

   • If you need to create a new environment for the gateway, click Add cloud environment, and create one. For more information about creating Environments, see Environments on Confluent Cloud.

3. On the page for your environment, click Network management in the navigation menu.

4. On the Network management page, under the For serverless products tab, click +Add gateway configuration.

5. On the Create gateway configuration page, under Choose type of networking gateway, select PrivateLink.

6. Under Set up connections to/from Confluent Cloud, for From your VPC or VNet to Confluent Cloud, click +Create configuration.

   The console opens the Configure gateway pane.

7. Under the 1. Gateway tab, configure the following settings:

   1. For Gateway name, enter a custom name for the gateway.

   2. For Cloud provider, select |aws|.

   3. For Set provider region, select the AWS Region where your VPC is located.

8. Click Submit. The Configure gateway pane shows the next set of steps under the 2. Access point tab.

9. Take note of the PrivateLink Service ID that the pane provides. You use this value next, when you create an AWS VPC endpoint.

At this point, you’re gateway is provisioned and has the CREATED state.

A gateway can have one of the following states:

• CREATED: The gateway is created and waiting for a access point to be created.

• READY: The access point is ready to be used.

• EXPIRED: A valid access point was not provisioned in the allotted time. A new gateway must be created.

Confluent REST API

1. Send a request to create a PrivateLink Gateway resource:

   REST request

   POST https://api.confluent.cloud/networking/v1/gateways
   

   REST request body

   {
     "spec": {
       "display_name": "<A custom name for the gateway>", "config": {
         "kind": "AwsIngressPrivateLinkGatewaySpec", "region": "<AWS
         region of the gateway>"
       }, "environment": {
         "id": "<The ID of the environment to add the gateway to>"
       }
     }
   }
   

Confluent CLI

Use the following command to create a PrivateLink Gateway:

confluent network gateway create <gateway-name> <flags>

The following command-specific flags are supported:

• --cloud: Required. The cloud provider. Set to aws.

• --region: Required. AWS region where the resources to be accessed using the gateway.

• --type: Required. The type of gateway configuration.

You can specify additional optional CLI flags described in the Confluent CLI command reference.

The following is an example Confluent CLI command to create a PrivateLink gateway:

confluent network gateway create my-ingress-gateway \
  --cloud aws \ --region us-west-2 \ --type ingress-privatelink

Terraform

Use the confluent_gateway Confluent Terraform Provider resource to create a PrivateLink Gateway.

The following is an example of a Terraform configuration:

resource "confluent_gateway" "aws_ingress" {
   display_name = "my-gateway" environment {
      id = "env-123abc"
   } aws_ingress_private_link_gateway {
      region = "us-west-2"
   }
}

Step 2: Create an AWS VPC endpoint

In AWS, create an endpoint that is associated with the PrivateLink Service ID of the ingress PrivateLink Gateway that you created.

AWS Management Console

1. In the AWS Management Console, go to the VPC service.

2. On the VPC dashboard page, do the following to verify that DNS hostnames and DNS resolution are enabled:

   1. In the navigation menu, under Virtual private cloud, click Your VPCs.

   2. Select the checkbox for your VPC, and click Actions > Edit VPC settings.

   3. Under DNS settings, verify that Enable DNS resolution and Enable DNS hostnames are selected.

   4. Click Save.

3. In the navigation menu under PrivateLink and Lattice, click Endpoints.

4. On the Endpoints page, click Create endpoint.

5. For Name tag, enter a name for the endpoint.

6. Under Type, select PrivateLink Ready partner services.

7. Under Service settings, for Service name, specify the PrivateLink Service ID of the gateway you created. Then, click Verify service.

   If you get an error, ensure that your account is authorized to create PrivateLink connections, and try again.

8. Under Network settings, for VPC, specify the ID of this VPC.

9. Under Additional settings, uncheck the Enable DNS name setting.

10. For Subnets, select the subnets in which to create an endpoint network interface.

11. Select or create a security group for the VPC Endpoint.

    • Add three inbound rules for each of ports 80, 443, and 9092 from your desired source (your VPC CIDR). The Protocol should be TCP for all three rules.

    • Port 80 is not required, but is available as a redirect only to https/443, if desired.

12. Click Create endpoint.

13. Note the VPC endpoint ID. You use this value next, when you create an ingress PrivateLink Access Point.

AWS CLI

aws ec2 create-vpc-endpoint --vpc-id <id of this VPC> \
  --service-name <privatelink attachment service id> \ --subnet-ids
  <subnet IDs for the endpoint> \ --region <region to use> \
  --private-dns-enabled false \ --vpc-endpoint-type Interface

Note that the VPC endpoint ID is created.

For example, using the information in status.cloud.vpc_endpoint_service_id in the PrivateLink Attachment status:

aws ec2 create-vpc-endpoint --vpc-id vpc-097799943f9fc059d \
  --service-name
  com.amazonaws.vpce.us-east-1.vpce-svc-123abcc1298abc123 \
  --subnet-ids subnet-7b16de0c \ --region us-east-1 \
  --private-dns-enabled false \ --vpc-endpoint-type Interface

AWS Terraform

Use the aws_vpc_endpoint AWS Terraform Provider resource to create a VPC endpoint in AWS.

Step 3: Create an ingress PrivateLink Access Point

An ingress PrivateLink Access Point registers a specific VPC endpoint with your ingress PrivateLink Gateway.

Confluent Cloud Console

1. To create an access point, navigate to either of the following locations in the Confluent Cloud console:

   • The Configure gateway pane where you created your gateway. You configure the access point under the 2. Access point tab.

   • The Create access point pane for your gateway. To open this pane, do the following:

     1. On the page for your environment, click Network management in the navigation menu.

     2. In the For serverless products tab, click your gateway name. Make sure the gateway is in the same region as your VPC private endpoint.

     3. Click the Access points tab, and click Create access point.

2. At step four, for VPC Endpoint ID from AWS, specify the ID of the VPC endpoint that you created.

3. At step five, for Access point name, enter a name.

4. Click Create access point.

   The PrivateLink Gateway and PrivateLink Access Point enter the READY state after the VPC interface endpoint connection is accepted.

Confluent REST API

1. Send a request to create a PrivateLink Access Point resource:

   REST request

   POST https://api.confluent.cloud/networking/v1/access-points
   

   REST request body

   {
     "spec": {
       "display_name": "<A custom name for the access point>",
       "config": {
         "kind": "AwsIngressPrivateLinkEndpoint", "vpc_endpoint_id":
         "<The ID of your VPC interface endpoint in AWS>"
       }, "environment": {
         "id": "<The ID of the environment that has the gateway for
         this access point>"
       }, "gateway": {
         "id": "<The ID of the gateway to add the access point to>"
       }
     }
   }
   

Confluent CLI

Use the following command to create a PrivateLink Access Point:

confluent network access-point private-link ingress-endpoint create
<access-point-name> <flags>

The following command-specific flags are supported:

• --cloud: Required. The cloud provider. Set to aws.

• --gateway: Required. The ID of the gateway ID to add the access point to.

• --vpc-endpoint-id: Required. The ID of your VPC interface endpoint in AWS.

You can specify additional optional CLI flags described in the Confluent CLI command reference.

The following is an example Confluent CLI command to create a PrivateLink access point:

confluent network access-point private-link ingress-endpoint create
my-ingress-access-point \ --cloud aws \ --gateway gw-123abc \
--vpc-endpoint-id vpce-1234567890abcdef0

Terraform

Use the confluent_access_point Confluent Terraform resource to create a PrivateLink Attachment Connection.

An example snippet of Terraform configuration for PrivateLink Attachment Connection:

resource "confluent_access_point" "aws_ingress_1" {
   display_name = "my_access_point" environment {
      id = "env-123abc"
   } gateway {
      id = "gw-123abc"
   } aws_ingress_private_link_endpoint {
      vpc_endpoint_id = "vpce-1234567890abcdef0"
   } depends_on = [
      confluent_gateway.aws_ingress
   ]
}

Step 4: Configure DNS

Confluent Cloud requires that you set up private DNS records for each access point pointing its DNS domain to the VPC endpoint you created.

When connecting to Confluent Cloud using access-point-specific hostnames, you must allow public DNS resolution from your network or VPC. Confluent Cloud advertises these hostnames in our public DNS resolver. These hostnames will then redirect to match the domains that you input to your private DNS resolver.

The resolution performs the following two-step process:

1. The Confluent Cloud Global DNS Resolver returns a CNAME for all of your hostnames removing the glb subdomain and converting your access point ID to be a subdomain.

   For example, with the given hostname:

   $lkc-id-$accesspointId.$region.$cloud.accesspoint.glb.confluent.cloud
   

   The CNAME returned will be:

   $lkc-id.$accesspointId.$region.$cloud.accesspoint.confluent.cloud
   

2. The CNAME then resolves to your VPC private endpoints based on the private DNS configuration.

If you are using AWS Route53 as your private DNS resolver, you can follow the steps below to configure DNS.

Set up a Route53 Private Hosted Zone in your AWS VPC for DNS resolution

1. In Confluent Cloud, verify that the status of the Gateway is READY.

2. Open the newly created Gateway to get the DNS domain value for your access point.

3. In the AWS Route 53 console, create a Route53 Private Hosted Zone:

   1. Specify the following values:

      • Domain name: The DNS domain value in Confluent Cloud.

      • Type: Private hosted zone

      • VPC ID: The ID of the VPC where you added the VPC endpoint.

   2. Click Create hosted zone to associate the Private Hosted Zone with your VPC.

4. Create a DNS record for the Hosted Zone you created above.

   This record is regional DNS and is used for all the target Confluent Cloud resources in the region.

   1. Click Create Record from within the previously created Hosted Zone.

   2. Specify the following values:

      • Record name: *

        Enter * as the subdomain name.

        The Record name consists of the subdomain and the DNS domain name. The DNS domain name is filled in with the Confluent Cloud DNS domain value you specified when you created the Route53 Private Hosted Zone in the previous step.

      • Record type: CNAME

      • Value: The DNS name of the VPC endpoint you created in Step 2: Create an AWS VPC endpoint.

        The value must be a fully qualified DNS name of the VPC endpoint. An example value would look like vpce-012c2200321aff207-gz49hgc1.vpce-svc-00da8c4990b89436d.us-west-2.vpce.amazonaws.com. Do not specify the VPC endpoint name.

        You can look up the DNS name on the Endpoint details page in the DNS names section.

      Note

      In Confluent Cloud, Kafka broker names you retrieve from the metadata are not static. Do not hardcode the broker names in DNS records.

   3. Click Create Record.

      You will see the summary of the new record.

Next steps

Try Confluent Cloud on AWS Marketplace with $1000 of free usage for 30 days, and pay as you go. No credit card is required.