Set up an AWS resource endpoint connection

Before you can configure AWS, you’ll need your account ID for AWS in Konnect. AWS uses this account ID to configure the connection between your resource share in AWS and Konnect.

1. In the Konnect sidebar, click Networks.
2. Click the settings icon next to your network.
3. Click Configure private networking.
4. Click Resource endpoint connection.
5. Copy and save the ID in the Kong AWS Account ID field.

To use AWS resource endpoints with Dedicated Cloud Gateways, you must first create a resource share with your resource configuration group and resource gateway in AWS.

1. In the AWS console, navigate to RAM.
2. Click Create resource share.
3. In the Name field, enter Kong-DCGW-Resource-Share.
4. From the Resource type dropdown menu, select “VPC Lattice Resource Configurations”.
5. Select the ARN of your resource configuration.
6. In the Selected resources settings, select your resource group IDs.
7. Click Next.
8. Click Next.
9. In the Principals settings, select Allow sharing with anyone.
10. From the Select principal type dropdown menu, select “AWS Account”.
11. In the AWS Account field, enter your account ID from Konnect.
12. Click Next.
13. Click Create resource share.

Important: Create a separate RAM share for each shared resource (do not include multiple resources in a single RAM share).

Now that the resource share is configured in AWS, you can connect it with Konnect to enable the resource endpoint connection.

1. In the Konnect sidebar, click Networks.
2. Click the action menu icon next to your network.
3. Click Configure private networking.
4. Click Resource endpoint connection.
5. In the Resource links configuration name field, enter AWS-Resource-Share.
6. In the AWS RAM share ARN field, enter your ARN.

7. Click Submit.

   It may take a few minutes for Konnect’s automation to accept the RAM share and create VPC endpoints. You can check the status of your resource endpoints in the table.

8. Click the action menu icon. Now you need to manually map your resource configuration IDs from AWS to Konnect once your resource endpoint is marked as Ready.
9. Click Edit.

10. In the Resource configuration ID field, enter your enter your resource configuration ID from AWS.

    Note: If your resource configuration has a child resource configuration, use the ID from the child resource.

11. In the Domain name field, enter your resource configuration domain name from AWS.

    Note: If your resource configuration has a child resource configuration, use the domain name from the child resource.

12. Click Submit.

It may take a few minutes for automation to update the private hosted zones and DNS settings before upstream routing will work.

Once the resource configuration mapping displays as Ready, your resource endpoint connection is set up successfully.

Additionally, you can validate that the resource endpoint connections in Konnect are working correctly by navigating to your Gateway Service configured in the prerequisites:

curl -i -X GET "$RESOURCE_DOMAIN_NAME"

When using AWS Resource Endpoints with Dedicated Cloud Gateways, traffic flows through AWS VPC Lattice before reaching your backend resources. VPC Lattice terminates the connection from your Dedicated Cloud Gateway and opens a new connection to your backend services. Because of this, the source IP of this new connection is an AWS-managed Lattice IP, not the original Dedicated Cloud Gateway IP.

To allow this traffic, you must configure the inbound security group rules for whatever resource is acting as your backend target (for example, EC2 instances, Application Load Balancers, Network Load Balancers, or target Elastic Network Interfaces).

1. In AWS, navigate to your VPC console.
2. From the VPC sidebar, click Managed prefix lists.
3. Search for the region where your backend resources (NLB/target group) are deployed (for example: com.amazonaws.<backend-resource-region>.vpc-lattice).
4. Copy the prefix list ID.
5. Navigate to the security group for your backend target resource.
6. Create a new security group or edit the inbound rules of an existing security group.
7. In the Source field, enter the prefix list IDs, for example pl-123456....
8. Repeat steps 1-7 for all regions where your backend resources are deployed.

If requests time out and your NLB shows no incoming traffic:

• Verify the security group attached to your backend allows the Lattice prefix list.
• Confirm the correct region-specific prefix list is used in your security group inbound rules.
• Validate the Resource Endpoint connection is in the READY state in Konnect.
• Confirm the Gateway Service upstream host matches the Resource Endpoint domain name.
• Check NLB target group health.
• Confirm backend subnet network access control lists (NACLs) allow inbound and outbound to the Lattice prefix. Security groups are stateful; a restrictive NACL silently drops the return path.
• Confirm the NLB listener protocol and port matches the resource configuration’s accepted listener.