<a id="cloud-networking-privatelink-aws-esku"></a>

# Use AWS PrivateLink for Serverless Products on Confluent Cloud

From your AWS virtual private cloud (VPC), you can use AWS PrivateLink to
privately access serverless Confluent Cloud products. These products include
Enterprise Kafka clusters, Schema Registry clusters, and Confluent Cloud for Apache Flink®. When you use
AWS PrivateLink, your Confluent resources are only accessible from private
endpoints in AWS that connect to your Confluent Cloud environment. To enable
PrivateLink connectivity, you create the following private networking resources
in your Confluent Cloud environment:

Ingress PrivateLink Gateway
: A reservation to establish a PrivateLink connection from your VPC to regional
  services in a Confluent Cloud environment.

Ingress PrivateLink Access Point
: A registration of a VPC interface endpoint that’s allowed to connect to a
  Confluent Cloud environment. A PrivateLink Access Point belongs to a specific PrivateLink Gateway.

These resources are regional and can be accessed from any availability zones.

#### NOTE
As of February 12th, 2026, the PrivateLink Attachment (PLATT) resource is
replaced by the ingress PrivateLink Gateway resource. A gateway provides the
same functionality as a PLATT, but it provides unique fully qualified domain
names (FQDNs) for each PrivateLink connection. With these FQDNs, your
applications can more granularly route traffic from your AWS VPC to the
services in your Confluent Cloud environment.

Existing PLATT resources will continue to function, but you won’t be able to
provision new ones following a future release. We recommend that you update
your applications to use gateways.

You can use the Confluent Cloud Console, the Confluent REST API, the Confluent CLI, or
Terraform to establish PrivateLink connectivity with the serverless products in
your Confluent Cloud environment.

## Requirements and considerations

* For the supported regions, see [Confluent Cloud Regions and Availability by Cloud Provider](../get-started/regions.md#providers-regions).
* Ingress PrivateLink Gateway resources don’t support PrivateLink connections to:
  * Different cloud regions.
  * Confluent Cloud resources in different environments.
* Each ingress PrivateLink Gateway supports up to 10 VPC endpoints.
* Confluent Cloud Console components, such as topic management and Flink workspaces, may
  require additional configuration because they use private endpoints that
  aren’t accessible from the public internet. For information about using Flink
  with AWS PrivateLink, see [Private Networking with Confluent Cloud for Apache Flink](../flink/concepts/flink-private-networking.md#flink-sql-private-networking). To use all
  features of the Confluent Cloud Console with AWS PrivateLink, see
  [Use the Confluent Cloud Console with Private Networking](ccloud-console-access.md#ccloud-console-access-networking).

<a id="privatelinkattachment-create"></a>

## Step 1: Create an ingress PrivateLink Gateway

Create an ingress PrivateLink Gateway to enable PrivateLink connections to the
Enterprise Kafka clusters, Schema Registry clusters, and the Flink service in an
environment for a specific cloud region.

### Confluent Cloud Console

1. In the Confluent Cloud Console, click **Environments** in the navigation menu.
2. On the **Environments** page, do one of the following:
   * If you already have the environment where you want to create the
     gateway, select it.
   * If you need to create a new environment for the gateway, click **Add
     cloud environment**, and create one. For more information about
     creating Environments, see [Environments on Confluent Cloud](../security/access-control/hierarchy/cloud-environments.md#cloud-environments).
3. On the page for your environment, click **Network management** in the
   navigation menu.
4. On the **Network management** page, under the **For serverless
   products** tab, click **+Add gateway configuration**.
5. On the **Create gateway configuration** page, under **Choose type of
   networking gateway**, select **PrivateLink**.
6. Under **Set up connections to/from Confluent Cloud**, for **From your
   VPC or VNet to Confluent Cloud**, click **+Create configuration**.

   The console opens the **Configure gateway** pane.
7. Under the **1. Gateway** tab, configure the following settings:
   1. For **Gateway name**, enter a custom name for the gateway.
   2. For **Cloud provider**, select **AWS**.
   3. For **Set provider region**, select the AWS Region where your VPC
      is located.
8. Click **Submit**. The **Configure gateway** pane shows the next set of
   steps under the **2. Access point** tab.
9. Take note of the **PrivateLink Service ID** that the pane provides. You
   use this value next, when you create an AWS VPC endpoint.

At this point, you’re gateway is provisioned and has the `CREATED`
state.

A gateway can have one of the following states:

* `CREATED`: You provisioned the gateway and can now add an access
  point.
* `READY`: You created the access point, and it can accept
  connections.
* `EXPIRED`: You didn’t provision a valid access point in the
  allotted time. Create a new gateway to continue.

### Confluent REST API

1. Send a request to create a PrivateLink Gateway resource:

   **REST request**
   ```rest
   POST https://api.confluent.cloud/networking/v1/gateways
   ```

   **REST request body**
   ```json
   {
     "spec": {
       "display_name": "<A custom name for the gateway>", "config": {
         "kind": "AwsIngressPrivateLinkGatewaySpec", "region": "<AWS
         region of the gateway>"
       }, "environment": {
         "id": "<The ID of the environment to add the gateway to>"
       }
     }
   }
   ```

   For more information, see [Gateways](https://docs.confluent.io/cloud/current/api.html#tag/Gateways-(networkingv1))
   in the Confluent REST API reference.

### Confluent CLI

Use the following command to create a PrivateLink Gateway:

```bash
confluent network gateway create <gateway-name> <flags>
```

The following command-specific flags are supported:

* `--cloud`: Required. The cloud provider. Set to `aws`.
* `--region`: Required. The AWS region of the gateway.
* `--type`: Required. The type of gateway configuration. Set to
  `ingress-privatelink`.

For more information, see [confluent network gateway create](https://docs.confluent.io/confluent-cli/current/command-reference/network/gateway/confluent_network_gateway_create.html).

The following is an example Confluent CLI command to create a
PrivateLink gateway:

```bash
confluent network gateway create my-ingress-gateway \
  --cloud aws \ --region us-west-2 \ --type ingress-privatelink
```

### Terraform

Use the `confluent_gateway` Confluent Terraform Provider resource to
create a PrivateLink Gateway. For more information, see
[confluent_gateway](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_gateway).

The following is an example of a Terraform configuration:

```terraform
resource "confluent_gateway" "aws_ingress" {
   display_name = "my-gateway" environment {
      id = "env-123abc"
   } aws_ingress_private_link_gateway {
      region = "us-west-2"
   }
}
```

<a id="privatelinkattachment-endpoint-create"></a>

## Step 2: Create an AWS VPC endpoint

In AWS, create an endpoint that is associated with the **PrivateLink Service
ID** of the ingress PrivateLink Gateway that you created.

### AWS Management Console

1. In the AWS Management Console, go to the **VPC** service.
2. On the **VPC dashboard** page, do the following to verify that DNS
   hostnames and DNS resolution are enabled:
   1. In the navigation menu, under **Virtual private cloud**, click
      **Your VPCs**.
   2. Select the checkbox for your VPC, and click **Actions** > **Edit VPC
      settings**.
   3. Under **DNS settings**, verify that **Enable DNS resolution** and
      **Enable DNS hostnames** are selected.
   4. Click **Save**.
3. In the navigation menu under **PrivateLink and Lattice**, click
   **Endpoints**.
4. On the **Endpoints** page, click **Create endpoint**.
5. For **Name tag**, enter a name for the endpoint.
6. Under **Type**, select **PrivateLink Ready partner services**.
7. Under **Service settings**, for **Service name**, specify the
   **PrivateLink Service ID** of the gateway you created. Then, click
   **Verify service**.

   If you get an error, ensure that your account is authorized to create
   PrivateLink connections, and try again.
8. Under **Network settings**, for **VPC**, specify the ID of this VPC.
9. Under **Additional settings**, uncheck the **Enable DNS name** setting.
10. For **Subnets**, select the subnets in which to create an endpoint
    network interface.
11. Select or create a security group for the VPC Endpoint.
    * Add three inbound rules for each of ports `80`, `443`, and
      `9092` from your desired source (your VPC CIDR). The **Protocol**
      should be `TCP` for all three rules.
    * Port `80` is not required, but is available as a redirect only to
      `https/443`, if desired.
12. Click **Create endpoint**.
13. Note the VPC endpoint ID. You use this value next, when you create an
    ingress PrivateLink Access Point.

### AWS CLI

```bash
aws ec2 create-vpc-endpoint --vpc-id <id of this VPC> \
  --service-name <privatelink attachment service id> \ --subnet-ids
  <subnet IDs for the endpoint> \ --region <region to use> \
  --no-private-dns-enabled \ --vpc-endpoint-type Interface
```

Note that the VPC endpoint ID is created.

For example, using the information in
`status.cloud.vpc_endpoint_service_id` in the PrivateLink Attachment status:

```bash
aws ec2 create-vpc-endpoint --vpc-id vpc-097799943f9fc059d \
  --service-name
  com.amazonaws.vpce.us-east-1.vpce-svc-123abcc1298abc123 \
  --subnet-ids subnet-7b16de0c \ --region us-east-1 \
  --no-private-dns-enabled \ --vpc-endpoint-type Interface
```

### AWS Terraform

Use the [aws_vpc_endpoint](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint)
AWS Terraform Provider resource to create a VPC endpoint in AWS.

<a id="privatelinkattachment-connection-create"></a>

## Step 3: Create an ingress PrivateLink Access Point

An ingress PrivateLink Access Point registers a specific VPC endpoint with your
ingress PrivateLink Gateway.

### Confluent Cloud Console

1. To create an access point, navigate to either of the following
   locations in the Confluent Cloud console:
   * The **Configure gateway** pane where you created your gateway. You
     configure the access point under the **2. Access point** tab.
   * The **Create access point** pane for your gateway. To open this pane,
     do the following:
     1. On the page for your environment, click **Network management** in
        the navigation menu.
     2. In the **For serverless products** tab, click your gateway name.
        Make sure the gateway is in the same region as your VPC private
        endpoint.
     3. Click the **Access points** tab, and click **Create access
        point**.
2. At step four, for **VPC Endpoint ID from AWS**, specify the ID of the
   VPC endpoint that you created.
3. At step five, for **Access point name**, enter a name.
4. Click **Create access point**.

   The PrivateLink Gateway and PrivateLink Access Point enter the `READY` state after
   the VPC interface endpoint connection is accepted.

### Confluent REST API

1. Send a request to create a PrivateLink Access Point resource:

   **REST request**
   ```rest
   POST https://api.confluent.cloud/networking/v1/access-points
   ```

   **REST request body**
   ```json
   {
     "spec": {
       "display_name": "<A custom name for the access point>",
       "config": {
         "kind": "AwsIngressPrivateLinkEndpoint", "vpc_endpoint_id":
         "<The ID of your VPC interface endpoint in AWS>"
       }, "environment": {
         "id": "<The ID of the environment that has the gateway for
         this access point>"
       }, "gateway": {
         "id": "<The ID of the gateway to add the access point to>"
       }
     }
   }
   ```

   For more information, see [Access Points](https://docs.confluent.io/cloud/current/api.html#tag/Access-Points-(networkingv1))
   in the Confluent REST API reference.

### Confluent CLI

Use the following command to create a PrivateLink Access Point:

```bash
confluent network access-point private-link ingress-endpoint create
<access-point-name> <flags>
```

The following command-specific flags are supported:

* `--cloud`: Required. The cloud provider. Set to `aws`.
* `--gateway`: Required. The ID of the gateway ID to add the access
  point to.
* `--vpc-endpoint-id`: Required. The ID of your VPC interface endpoint
  in AWS.

For more information, see [confluent network access-point private-link
ingress-endpoint create](https://docs.confluent.io/confluent-cli/current/command-reference/network/access-point/private-link/ingress-endpoint/confluent_network_access-point_private-link_ingress-endpoint_create.html).

The following is an example Confluent CLI command to create a
PrivateLink access point:

```bash
confluent network access-point private-link ingress-endpoint create
my-ingress-access-point \ --cloud aws \ --gateway gw-123abc \
--vpc-endpoint-id vpce-1234567890abcdef0
```

### Terraform

Use the `confluent_access_point` Confluent Terraform Provider resource
to create a PrivateLink Access Point. For more information, see
[confluent_access_point](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_access_point).

The following is an example of a Terraform configuration:

```terraform
resource "confluent_access_point" "aws_ingress_1" {
   display_name = "my_access_point" environment {
      id = "env-123abc"
   } gateway {
      id = "gw-123abc"
   } aws_ingress_private_link_endpoint {
      vpc_endpoint_id = "vpce-1234567890abcdef0"
   } depends_on = [
      confluent_gateway.aws_ingress
   ]
}
```

<a id="privatelinkattachment-dns"></a>

## Step 4: Configure DNS

Confluent Cloud requires that you set up private DNS records for each access point
pointing its DNS domain to the VPC endpoint you created.

When connecting to Confluent Cloud using access-point-specific hostnames, you must
allow public DNS resolution from your network or VPC. Confluent Cloud advertises these
hostnames in our public DNS resolver. These hostnames will then redirect to
match the domains that you input to your private DNS resolver.

The resolution performs the following two-step process:

1. The Confluent Cloud Global DNS Resolver returns a CNAME for all of your hostnames
   removing the `glb` subdomain and converting your access point ID to be a
   subdomain.

   For example, with the given hostname:
   ```bash
   $lkc-id-$accesspointId.$region.$cloud.accesspoint.glb.confluent.cloud
   ```

   The CNAME returned will be:
   ```bash
   $lkc-id.$accesspointId.$region.$cloud.accesspoint.confluent.cloud
   ```
2. The CNAME then resolves to your VPC private endpoints based on the private
   DNS configuration.

If you are using AWS Route53 as your private DNS resolver, you can follow the
steps below to configure DNS.

### Set up a Route53 Private Hosted Zone in your AWS VPC for DNS resolution

1. In Confluent Cloud, verify that the status of the Gateway is `READY`.
2. Open the newly created Gateway to get the DNS domain value for your access
   point.
3. In the AWS Route 53 console, create a Route53 Private Hosted Zone:
   1. Specify the following values:
      * **Domain name**: The DNS domain value in Confluent Cloud.
      * **Type**: `Private hosted zone`
      * **VPC ID**: The ID of the VPC where you added the VPC endpoint.
   2. Click **Create hosted zone** to associate the Private Hosted Zone with
      your VPC.
4. Create a DNS record for the Hosted Zone you created above.

   This record is regional DNS and is used for all the target Confluent Cloud resources
   in the region.
   1. Click **Create Record** from within the previously created Hosted Zone.
   2. Specify the following values:
      * **Record name**: `*`

        Enter `*` as the subdomain name.

        The Record name consists of the subdomain and the DNS domain name. The
        DNS domain name is filled in with the Confluent Cloud DNS domain value you
        specified when you created the Route53 Private Hosted Zone in the
        previous step.
      * **Record type**: `CNAME`
      * **Value**: The DNS name of the VPC endpoint you created in
        [Step 2: Create an AWS VPC endpoint](#privatelinkattachment-endpoint-create).

        The value must be a fully qualified DNS name of the VPC endpoint. An
        example value would look like
        `vpce-012c2200321aff207-gz49hgc1.vpce-svc-00da8c4990b89436d.us-west-2.vpce.amazonaws.com`.
        Do not specify the VPC endpoint name.

        You can look up the DNS name on the Endpoint details page in the **DNS
        names** section.

      #### NOTE
      In Confluent Cloud, Kafka broker names you retrieve from the metadata are not
      static. Do not hardcode the broker names in DNS records.
   3. Click **Create Record**.

      You will see the summary of the new record.

## Next steps

Try [Confluent Cloud on AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-g5ujul6iovvcy?trk=14575e70-1766-4f20-8083-0c2757a1ec75&sc_channel=el)
with $1000 of free usage for 30 days, and pay as you go. No credit card is
required.