AWS PrivateLink peering

You can establish a private connection between Konnect and your AWS environment using AWS PrivateLink. This provides secure communication between your Data Plane and the Control Plane, reducing data transfer costs and ensuring compliance.

You can configure this instead of AWS Transit Gateways to secure your connection.

PrivateLink support is currently available in the following AWS regions:

• us-east-2
• us-west-2
• eu-central-1
• eu-west-1
• eu-west-2
• ap-southeast-1
• ap-southeast-2

If your AWS region is not listed, contact Kong Support.

Before creating a PrivateLink connection, ensure that you have a VPC, subnets, and a security group configured in your AWS account. For instructions, see the Amazon VPC documentation.

1. Navigate to VPC > Endpoints in the AWS Console.
2. Select Create Endpoint.
3. Choose the service category Endpoint services that use Network Load Balancers and Gateway Load Balancers.
4. Enter a name tag for the endpoint (for example, konnect-us-geo) indicating the Konnect geo.
5. Locate the appropriate PrivateLink service name from the tables in the following section based on your AWS region and Konnect geo.
6. Select your VPC, subnets, and security group for the endpoint. Ensure the following settings are configured:
   • The security group allows inbound TCP traffic on port 443.
   • Private DNS is enabled in the additional settings.
7. Create the endpoint and wait until the status is available. We recommend waiting 10 minutes before using the endpoint.

8. After your PrivateLink endpoint is available, update your Data Plane configuration in the kong.conf file to connect to the Konnect Control Plane using the private DNS name for your region.

   Here’s an example kong.conf configuration for the US region:

   cluster_control_plane = us.svc.konghq.com/cp/$CLUSTER_PREFIX
   cluster_server_name = us.svc.konghq.com
   cluster_telemetry_endpoint = us.svc.konghq.com:443/tp/$CLUSTER_PREFIX
   cluster_telemetry_server_name = us.svc.konghq.com
   

The following tables show the PrivateLink service name and DNS name for each supported AWS region and Konnect geo: