<a id="cloud-networking-privatelink-azure-egress-esku"></a>

# Use Azure Egress Private Link Endpoints for Serverless Products on Confluent Cloud

[Azure Private Link](https://azure.microsoft.com/en-us/services/private-link/) is a networking
service that allows one-way connectivity from one VNet to a service provider. It
is popular for its unique combination of security and simplicity.

Confluent Cloud supports outbound Azure Private Link connections using Egress Private
Link Endpoints. Egress Private Link Endpoints are [Azure Private Endpoints](https://learn.microsoft.com/en-us/azure/private-link/create-private-endpoint-portal?tabs=dynamic-ip),
and they enable Confluent Cloud clusters to access supported Azure services and other
endpoint services powered by Azure Private Link, such as Azure Blob Storage, a
SaaS service, or a Private Link service that you create yourself.

To set up an Egress Private Link Endpoint from Confluent Cloud to an external system,
you use an outbound networking gateway and an access point

#### NOTE
All Enterprise clusters in a region within a given environment share the same
gateway and its access points.

The following diagram summarizes the Egress Private Link Endpoint architecture
between Confluent Cloud and various potential destinations.

![Azure Egress Private Link Endpoint architecture](networking/images/azure-eap-architecture.png)

The high level workflow to set up an Egress Private Link Endpoint from Confluent Cloud
to an external system, such as for managed connectors is:

1. [Create a gateway for outbound connectivity in Confluent Cloud](#azure-privatelink-egress-create-gateway-esku).
2. [Obtain the Azure Private Link service resource ID](#azure-private-link-egress-obtain-service-name-esku).

   For certain target services, you can retrieve the service resource ID as part
   of the guided workflow while creating an Egress Private Link Endpoint in the
   next step.
3. [Create an Egress Private Link Endpoint in Confluent Cloud](#azure-private-link-egress-create-access-point-esku).
4. [[Optional] Create private DNS records for use with Azure private endpoints](#azure-private-link-egress-dns-records-esku).

For service/connector-specific setup, see the [target system networking
supportability table](../connectors/networking/internet-resource.md#connect-cloud-target-system-networking-supportability).

## Requirements and considerations

Review the following requirements and considerations before you set up an Egress
Private Link Endpoint using Azure Private Link:

* Egress Private Link Endpoints described in this document is only available for
  use with Enterprise clusters.
* One Egress Private Link gateway per region per environment is allowed.
* For cross-region Egress Private Link connections, contact Confluent Support to
  see if your regions are supported and to have the request approved.
* Egress Private Link Endpoints can only be used by fully managed connectors.

#### NOTE
It is **strongly recommended** that you do not implement any automated
policies for endpoint acceptance. Confluent Cloud uses a shared subscription when
provisioning endpoints. You should manually accept each endpoint connection
after validating that the private endpoint ID you see in the Azure portal
matches what you see in the Confluent Cloud Console.

* When using Egress Private Link Endpoints, additional charges may apply, for
  example, for certain connector configurations. For more information, see
  the following pricing information:
  * [Confluent pricing](https://www.confluent.io/confluent-cloud/pricing/)
  * [Fully managed Kafka Connector pricing](https://www.confluent.io/confluent-cloud/connect-pricing/)

<a id="azure-privatelink-egress-create-gateway-esku"></a>

## Create a gateway for outbound connectivity in Confluent Cloud

In order for Confluent Serverless products to be able to leverage Egress
Private Link Endpoints for outbound connectivity, you first need to enable
private egress connectivity by creating a gateway.

To create an egress private link gateway:

### Confluent Cloud Console

1. In the Confluent Cloud Console, select an environment for the Egress
   Private Link Endpoint.
2. In the **Network management** tab in the environment, click
   **For serverless products**.
3. Click **Add gateway configuration**.
4. Click **+ Create configuration** on the **From Confluent Cloud to
   your external data systems** pane.
5. On the **Configure gateway** sliding panel, enter the following
   information.
   * Gateway name
   * Cloud provider
   * Region
6. Click **Submit**.
7. You can continue to create [an access point for an Egress Private Link
   Endpoint](#azure-private-link-egress-create-access-point-esku).

   Alternatively, you can create an access point at a later time by
   navigating to this gateway in the **Network management** tab.

### Confluent REST API

Send a request to create a gateway:

**HTTP POST request**

```text
POST https://api.confluent.cloud/networking/v1/gateways
```

**Authentication**

See [Authentication](https://docs.confluent.io/cloud/current/api.html/#authentication).

**Request specification**

```json
{
  "spec": {
    "display_name": "<The custom name for the endpoint>",
    "gateway_type": "AzureEgressPrivateLink",
    "config": {
      "kind": "AzureEgressPrivateLinkGatewaySpec",
      "region": "<Azure region of the Egress Private Link Gateway>"
    },
    "environment": {
      "id": "<The environment ID where the endpoint belongs to>",
      "environment": "<Environment of the gateway>"
    }
  }
}
```

### Confluent CLI

Use the [confluent network gateway create](https://docs.confluent.io/confluent-cli/current/command-reference/network/gateway/confluent_network_gateway_create.html)
Confluent CLI command to create a gateway:

```bash
confluent network gateway create [name] [flags]
```

The following are the command-specific flags:

* `--cloud`: Required. The cloud provider. Set to `azure`.
* `--region`: Required. Azure region of the gateway.
* `--type` : Required. The gateway type. Set to `egress-privatelink`.

You can specify additional optional CLI flags described in the [Confluent
CLI command reference](https://docs.confluent.io/confluent-cli/current/command-reference/overview.html),
such as `--environment`.

### Terraform

Use the [confluent_gateway](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_gateway)
Confluent Terraform Provider resource to create an outbound gateway.

An example snippet of Terraform configuration:

```terraform
resource "confluent_environment" "development" {
  display_name = "Development"
}

resource "confluent_gateway" "main" {
  display_name = "my_gateway"
  environment {
    id = confluent_environment.development.id
  }
  azure_egress_private_link_gateway {
    region = "centralus"
  }
}
```

<a id="azure-private-link-egress-obtain-service-name-esku"></a>

## Obtain Azure Private Link Resource ID

To make an Azure Private Link connection from Confluent Cloud to an external system, you
must first obtain an Azure Private Link Resource ID for Confluent to establish a
connection to.

Depending on the system you wish to connect to, there may be different allowlist
requirements to allow Confluent access. It is recommended that you check each
system’s allowlist mechanism to verify that Confluent Cloud will be able to create an
endpoint targeting that system.

### For Azure services

Refer to your specific Azure resource to obtain its Resource ID. Along with the
specific ID, you will also need to [obtain the Sub-resource name](https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview#private-link-resource)
depending on the resource you are connecting to.

### For 3rd party services

Refer to the system provider’s documentation for how to obtain the Azure Resource
ID to determine allowlisting requirements.

The following are reference links for some of the popular system providers:

* [Snowflake](https://docs.snowflake.com/en/user-guide/privatelink-azure)
* [MongoDB Atlas](https://www.mongodb.com/docs/atlas/security-private-endpoint/#learn-about-private-endpoints-in-service)
* [Elastic Cloud](https://www.elastic.co/guide/en/cloud/current/ec-traffic-filtering-vnet.html)

### For Azure Private Link Services you create

Refer to the Azure documentation for how to [create a private link service
available to service consumers](https://learn.microsoft.com/en-us/azure/private-link/create-private-link-service-portal?tabs=dynamic-ip).

For step-by-step guide on how to set up an Egress Private Link to connect to
self-managed services, see the [Confluent Cloud connector document](../connectors/networking/azure-eap-self-managed.md#cc-azure-eap-self-managed).

<a id="azure-private-link-egress-create-access-point-esku"></a>

## Create an Egress Private Link Endpoint in Confluent Cloud

Confluent Cloud Egress Private Link Endpoints are [Azure Private Endpoints](https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview)
used to connect to Azure Private Link Services.

### Confluent Cloud Console

1. In the **Network Management** tab of the desired Confluent Cloud environment,
   click the **For serverless products** tab.
2. Click the gateway to which you want to add the Private Link Endpoint.
3. In the **Access points** tab, click **Add access point**.
4. Select the service you want to connect to.

   Specific services are listed based on the cloud provider for the
   gateway.
5. Follow the guided steps to specify the field values, including:
   * **Access point name**: The name of the Private Link Endpoint.
   * **Resource ID**: The resource ID of the Private Link service you
     retrieved as part of this guided workflow or as described in
     [Obtain Azure Private Link Resource ID](#azure-private-link-egress-obtain-service-name-esku).

     Note that the resource alias is not supported.
   * **Sub-resource name**: The sub-resource name for the specific
     Azure service you retrieved in
     [Obtain Azure Private Link Resource ID](#azure-private-link-egress-obtain-service-name-esku).
6. Click **Create access point** to create the Private Link Endpoint.
7. If there are additional steps for the specific target service, follow
   the prompt to complete the tasks, and then click **Finish**.
8. If the service requires a DNS setup, you can create a DNS record when
   the access point is successfully created.

   Specify the **Domain** name, and click **Create DNS record**.

   Alternatively, you can create a DNS record as described in
   [Create a private DNS record in Confluent Cloud](#azure-private-link-egress-dns-records-esku) if the access point
   creation takes too long.

### Confluent REST API

Send a request to create an endpoint:

**HTTP POST request**

```text
POST https://api.confluent.cloud/networking/v1/access-points
```

**Authentication**

See [Authentication](https://docs.confluent.io/cloud/current/api.html/#authentication).

**Request specification**

```json
{
  "spec": {
    "display_name": "<The custom name for the endoint>",
    "config": {
      "kind": "AzureEgressPrivateLinkEndpoint",
      "private_link_service_resource_id": "<ID of the Azure Private Link service you wish to connect to>",
      "private_link_subresource_name": "<Names of subresources which the Private Endpoint is able to connect to>"
    },
    "environment": {
      "id": "<The environment ID where the endpoint belongs to>",
      "environment": "<The environment name where the endpoint belongs to>"
    },
    "gateway": {
      "id": "<The gateway ID to which this belongs>",
      "environment": "<Environment of the referred resource, if env-scoped>"
    }
  }
}
```

* `private_link_service_resource_id` and
  `private_link_subresource_name`: See [Obtain the Azure
  Private Link service resource ID](#azure-private-link-egress-obtain-service-name-esku).

An example request spec to create an endpoint:

```json
{
  "spec": {
    "display_name": "prod-plap-egress-usw2",
    "config": {
      "kind": "AzureEgressPrivateLinkEndpoint",
      "private_link_service_resource_id": "/subscriptions/0000000/resourceGroups/plsRgName/providers/Microsoft.Network/privateLinkServices/privateLinkServiceName"
    },
    "environment": {
      "id": "env-00000",
    },
    "gateway": {
      "id": "gw-00000",
    }
  }
}
```

### Confluent CLI

Use the [confluent network access-point private-link egress-endpoint create](https://docs.confluent.io/confluent-cli/current/command-reference/network/access-point/private-link/egress-endpoint/confluent_network_access-point_private-link_egress-endpoint_create.html)
Confluent CLI command to create an Egress Private Link Endpoint:

```bash
confluent network access-point private-link egress-endpoint create [name] [flags]
```

The following are the command-specific flags:

* `--cloud`: Required. The cloud provider. Set to `azure`.
* `--service`: Required. ID of the Azure Private Link service you wish
  to connect to.

  See [Obtain the Azure Private Link service resource ID](#azure-private-link-egress-obtain-service-name-esku).
* `subresource`: The sub-resource name for the specific Azure service you
  retrieved in
  [Obtain Azure Private Link Resource ID](#azure-private-link-egress-obtain-service-name-esku).
* `--gateway`: Required. Gateway ID.

You can specify additional optional CLI flags described in the [Confluent
CLI command reference](https://docs.confluent.io/confluent-cli/current/command-reference/overview.html),
such as `--environment`.

The following is an example Confluent CLI command to create an Azure
Egress Private Link Endpoint:

```bash
confluent network access-point private-link egress-endpoint create \
  --cloud azure \
  --gateway gw-123456 \
  --service /subscriptions/0000000/resourceGroups/plsRgName/providers/Microsoft.Network/privateLinkServices/privateLinkServiceName \
```

You can specify additional optional CLI flags described in the [Confluent
CLI command reference](https://docs.confluent.io/confluent-cli/current/command-reference/overview.html),
such as `--environment`.

### Terraform

Use the [confluent_access_point](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_access_point)
resource to create an Egress Private Link Endpoint.

An example snippet of Terraform configuration:

```terraform
resource "confluent_environment" "development" {
  display_name = "Development"
}

resource "confluent_access_point" "main" {
  display_name = "access_point"
  environment {
    id = confluent_environment.development.id
  }
  gateway {
    id = confluent_network.main.gateway[0].id
  }
  azure_egress_private_link_endpoint {
    private_link_service_resource_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/s-abcde/providers/Microsoft.Network/privateLinkServices/pls-plt-abcdef-az3"
  }
}
```

<br/>

Your Egress Private Link Endpoint status will transition from “Provisioning” to “Ready”
in the Confluent Cloud Console when the endpoint has been created and can be used. Some
endpoints may need to be manually accepted before transitioning to “Ready”.

Once an endpoint is created, connectors provisioned against Enterprise Kafka
clusters can leverage the Egress Private Link Endpoint to access the external
data systems.

Confluent Cloud exposes various pieces of information for each of the above Egress
Private Link Endpoints so that you can use it in various network-related policies.

<a id="azure-private-link-egress-dns-records-esku"></a>

## Create a private DNS record in Confluent Cloud

Create private DNS records for use with Azure private endpoints.

Not all service providers set up public DNS records to be used when connecting
to them with Azure Private Link. For situations where a system provider requires
setting up private DNS records in conjunction with Azure Private Link, you need
to create DNS records in Confluent Cloud.

Before you create a DNS Record, first [create an Egress Private Link
Endpoint](#azure-private-link-egress-create-access-point-esku) and use the
Access Point ID for the DNS record.

When creating DNS records, Confluent Cloud creates a single `*` record that maps
the domain name you specify to the IP address of the private endpoint.

For example, in setting up DNS records for Snowflake, the DNS zone configuration
will look like:

```text
*.eastus2.privatelink.snowflakecomputing.com A 10.2.0.1 TTL 60
```

### Confluent Cloud Console

1. In the **Network Management** tab of your environment, click the
   Confluent Cloud gateway you want to add the DNS record to.
2. In the **DNS** tab, click **Create DNS record**.
3. Specify the following field values.
   * **Egress Private Link Endpoint**: The Access Point ID
     you created in [create an Egress Private Link Endpoint](#azure-private-link-egress-create-access-point-esku).
   * **Domain**: The domain of the private link service you wish to
     access. For multiple domains, for example, with the Cosmo DB
     connector, create a separate DNS record for each of the domain
     values.

     Get the domain values from the private link service provider, Azure
     or a third-party provider. See [Azure Private Endpoint private DNS zone values](https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns) for the list of domain values.
4. Click **Save**.

### Confluent REST API

Send a request to create a DNS Record that is associated with a
Private Link Endpoint that is associated with a gateway.

**HTTP POST request**

```text
POST https://api.confluent.cloud/networking/v1/dns-records
```

**Authentication**

See [Authentication](https://docs.confluent.io/cloud/current/api.html/#authentication).

**Request specification**

```json
{
  "spec": {
    "display_name": "The name of this DNS record",
    "domain": "<The fully qualified domain name of the external system>",
    "config": {
      "kind": "PrivateLinkAccessPoint",
      "resource_id": "<The ID of the endpoint that you created>"
    },
    "environment": {
      "id": "<The environment ID where this resource belongs to>",
      "environment": "<Environment of the referred resource, if env-scoped>"
    },
    "gateway": {
      "id": "<The gateway ID to which this belongs>",
      "environment": "<Environment of the referred resource, if env-scoped>"
    }
  }
}
```

Get the `spec.domain` value from the private link service provider,
Azure or a third-party provider/

To get the gateway id, issue the following API request:

```rest
GET https://api.confluent.cloud/networking/v1/networks/{Confluent Cloud network ID}
```

You can find the gateway id in the response under `spec.gateway.id`.

An example request spec to create a DNS record:

```json
{
  "spec": {
    "display_name": "prod-dns-record1",
    "domain": "example.com",
    "config": {
      "kind": "PrivateLinkAccessPoint",
      "resource_id": "plap-12345"
    },
    "environment": {
      "id": "env-00000",
    },
    "gateway": {
      "id": "gw-00000",
    }
  }
}
```

### Confluent CLI

Use the [confluent network dns record create](https://docs.confluent.io/confluent-cli/current/command-reference/overview.html)
Confluent CLI command to create a DNS record:

```bash
confluent network dns record create [name] [flags]
```

The following are the command-specific flags:

* `--private-link-access-point`: Required. Private Link Private Link Endpoint ID.
* `--gateway`: Required. Gateway ID.
* `--domain`: Required. Fully qualified domain name of the external
  system. Get the domain value from the private link service provider,
  Azure or a third-party provider.

You can specify additional optional CLI flags described in the [Confluent
CLI command reference](https://docs.confluent.io/confluent-cli/current/command-reference/overview.html),
such as `--environment`.

The following is an example Confluent CLI command to create DNS record
for an endpoint:

```bash
confluent network dns record create my-dns-record \
  --gateway gw-123456 \
  --private-link-access-point ap-123456 \
  --domain xyz.westeurope.privatelink.snowflakecomputing.com
```

### Terraform

Use the [confluent_dns_record](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_dns_record)
Confluent Terraform Provider resource to create DNS records.

An example snippet of Terraform configuration:

```terraform
resource "confluent_environment" "development" {
  display_name = "Development"
}

resource "confluent_dns_record" "main" {
  display_name = "dns_record"
  environment {
    id = confluent_environment.development.id
  }
  domain = "example.com"
  gateway {
    id = confluent_gateway.main.id
  }
  private_link_access_point {
    id = confluent_access_point.main.id
  }
}
```

## Support for Azure Private Link Service configuration

Confluent Support can help with issues you may encounter when creating an Access
Point to a specific service or resource.

For any service-side problems, such as described below, Confluent is not
responsible for proper Azure Private Link Service configuration or setup:

* If you need help setting up an Azure Private Link Service for data systems
  running within your environment or VNet that you want to connect to from
  Confluent Cloud, contact Azure for configuration help and best practices.
* If you need help configuring Azure Private Link Services for those managed by a
  third-party provider or service, contact that provider for compatibility and
  proper setup.