|
| 1 | +--- |
| 2 | +Title: Connect to Amazon Web Services PrivateLink |
| 3 | +alwaysopen: false |
| 4 | +categories: |
| 5 | +- docs |
| 6 | +- operate |
| 7 | +- rc |
| 8 | +description: null |
| 9 | +linkTitle: AWS PrivateLink |
| 10 | +weight: 80 |
| 11 | +bannerText: AWS PrivateLink is currently in preview. Features and behavior are subject to change. Redis does not recommend using AWS PrivateLink in production environments. |
| 12 | +--- |
| 13 | + |
| 14 | +[Amazon Web Services (AWS) PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-resources.html) allows service providers to securely expose specific services without exposing the entire service provider and consumer VPCs to each other. With AWS PrivateLink, Redis Cloud exposes a VPC endpoint service that you connect to as a consumer from your own VPC. Traffic stays within the AWS network and is isolated from external networks. |
| 15 | + |
| 16 | +{{< note >}} |
| 17 | +Connecting to Redis Cloud with an AWS PrivateLink is available only with Redis Cloud Pro. It is not supported for Redis Cloud Essentials. |
| 18 | +{{< /note >}} |
| 19 | + |
| 20 | +You can use PrivateLink as an alternative to Layer 3 connectivity options like [VPC peering]({{< relref "/operate/rc/security/vpc-peering" >}}) and [Transit Gateway]({{< relref "/operate/rc/security/aws-transit-gateway" >}}). |
| 21 | + |
| 22 | +AWS PrivateLink provides the following benefits: |
| 23 | + |
| 24 | +- **Improved Security**: PrivateLink exposes the Redis cluster and database(s) as a unidirectional endpoint inside your consumer VPC, thereby avoiding exposing entire VPC subnets to each other and eliminating some possible attack vectors. |
| 25 | +- **Network Flexibility**: PrivateLink enables cross-account and cross-VPC connectivity and can be configured even when the Redis Cloud VPC and your consumer VPC have overlapping CIDR/IP ranges. |
| 26 | +- **Simplified architecture and low latency**: PrivateLink does not require NAT, internet gateways, or VPNs. It provides simplified network routing, without the need for a network load balancer between the application and the Redis database. |
| 27 | + |
| 28 | +## Limitations |
| 29 | + |
| 30 | +Be aware of the following limitations when using PrivateLink with Redis Cloud: |
| 31 | +- You cannot use the [OSS Cluster API]({{< relref "/operate/rc/databases/configuration/clustering#oss-cluster-api" >}}) with PrivateLink during preview. |
| 32 | +- You cannot use Layer 3 connectivity options like VPC peering or Transit Gateway with PrivateLink during private preview. |
| 33 | +- Redis Cloud subscriptions with AWS PrivateLink are limited to a maximum of 55 databases. [Contact support](https://redis.com/company/support/) if you need more than 55 databases in one subscription with AWS PrivateLink. |
| 34 | +- Your subnets must have at least 16 available IP addresses for the resource endpoint. |
| 35 | +- Some AWS regions do not support PrivateLink Resource Endpoints. See [AWS VPC Lattice Pricing](https://aws.amazon.com/vpc/lattice/pricing/) for a list of regions that support AWS PrivateLink Resource Endpoints. |
| 36 | +- Redis Cloud's PrivateLink implementation uses PrivateLink Resource Endpoints, which is based on Amazon VPC Lattice, so the [VPC Lattice quotas](https://docs.aws.amazon.com/vpc-lattice/latest/ug/quotas.html) apply. Currently, the following availability zones are not supported with Amazon VPC Lattice: |
| 37 | + - `use1-az3` |
| 38 | + - `usw1-az2` |
| 39 | + - `apne1-az3` |
| 40 | + - `apne2-az2` |
| 41 | + - `euc1-az2` |
| 42 | + - `euw1-az4` |
| 43 | + - `cac1-az3` |
| 44 | + - `ilc1-az2` |
| 45 | + |
| 46 | + We recommend avoiding these availability zones when creating your Redis Cloud database if you plan to use AWS PrivateLink. |
| 47 | +- Redis Cloud [Bring your Own Cloud]({{< relref "/operate/rc/subscriptions/bring-your-own-cloud" >}}) subscriptions are not supported with PrivateLink. |
| 48 | + |
| 49 | +## Prerequisites |
| 50 | + |
| 51 | +Before you can connect to Redis Cloud with an AWS PrivateLink VPC resource endpoint, you must have: |
| 52 | + |
| 53 | +- A [Redis Cloud Pro database]({{< relref "/operate/rc/databases/create-database/create-pro-database-new" >}}) |
| 54 | +- An [AWS VPC](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html) with the following: |
| 55 | + - A [security group](https://docs.aws.amazon.com/vpc/latest/userguide/creating-security-groups.html) that allows ingress traffic to the following ports: |
| 56 | + - The database port range (port 10000-19999) |
| 57 | + - The Redis Cloud metrics port (port 8070), if desired |
| 58 | + - Subnets in the same region as your Redis Cloud database. |
| 59 | + - Settings to allow **DNS resolution** and **DNS hostnames**. See [View and update DNS attributes for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns-updating.html) for more information. |
| 60 | +- Permission to create and manage VPC endpoints or Service networks in AWS. |
| 61 | + |
| 62 | +## Set up PrivateLink connection |
| 63 | + |
| 64 | +To set up a connection to Redis Cloud with an AWS PrivateLink VPC resource endpoint, you need to: |
| 65 | + |
| 66 | +1. [Associate the Redis Cloud Resource share with one or more AWS principals](#associate-resource-share). |
| 67 | +1. [Add a connection](#add-connection) from your consumer account using a VPC resource endpoint or a VPC Lattice service network. |
| 68 | + |
| 69 | +### Associate Redis Cloud resource share with a principal {#associate-resource-share} |
| 70 | + |
| 71 | +In this step, you will associate the Redis Cloud resource share with an AWS principal, such as an AWS Account. |
| 72 | + |
| 73 | +1. From the [Redis Cloud console](https://cloud.redis.io/), select the **Subscriptions** menu and then select your subscription from the list. |
| 74 | + |
| 75 | +1. Select **Connectivity > PrivateLink** to view the PrivateLink settings. |
| 76 | + |
| 77 | +1. In the **Resource Share** section, select **Manage Principals** to open the **Manage Principals** window. |
| 78 | + |
| 79 | + {{<image filename="images/rc/privatelink-resource-share.png" width="80%" alt="The Resource Share section, with the manage principals button." >}} |
| 80 | + |
| 81 | + {{<image filename="images/rc/privatelink-manage-principals.png" width="80%" alt="The Manage Principals window lets you add and remove principals from the resource share." >}} |
| 82 | + |
| 83 | +1. Select the **Add** button in the **AWS consumer principals** section to add a principal to the resource share. |
| 84 | + |
| 85 | + {{<image filename="images/rc/icon-add.png" width="30px" alt="The Add button adds principals to the resource share." >}} |
| 86 | + |
| 87 | +1. Select the type of principal you want to add from the **Principal type** list. You can choose from the following principal types: |
| 88 | + |
| 89 | + - AWS account |
| 90 | + - [Organization](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html) |
| 91 | + - [Organizational unit (OU)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_ous.html) |
| 92 | + - [Identity and Access Management (IAM) role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) |
| 93 | + - [IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html) |
| 94 | + - Service principal |
| 95 | + |
| 96 | +1. Enter the principal's ID in the **Principal ID** field. You can also add an optional alias in the **AWS principal alias** field. |
| 97 | + |
| 98 | + {{<image filename="images/rc/privatelink-aws-consumer-principals.png" width="80%" alt="The AWS consumer principals section with an AWS account added as a principal." >}} |
| 99 | + |
| 100 | +1. Select **Share** to share the resource share with the principal. The first resource share may take a few minutes. |
| 101 | + |
| 102 | +1. After sharing the resource share with the principal, [accept the resource share in the Resource Access Manager](https://docs.aws.amazon.com/ram/latest/userguide/working-with-shared-invitations.html) or copy the **Accept resource share** command and run it with the AWS CLI. |
| 103 | + |
| 104 | +After you accept the resource share, the Redis Cloud console will show the principal as **Accepted**. |
| 105 | + |
| 106 | +{{<image filename="images/rc/privatelink-principal-accepted.png" width="80%" alt="The Consumer Principals section, with the consumer principal shown as accepted." >}} |
| 107 | + |
| 108 | +You can add additional principals to the resource share at any time. |
| 109 | + |
| 110 | +### Add a connection {#add-connection} |
| 111 | + |
| 112 | +In this step, you will add a connection from your consumer account using a VPC resource endpoint or a VPC lattice service network. |
| 113 | + |
| 114 | +From the **Connectivity > PrivateLink** tab in your Redis Cloud subscription, open the **Add connection** section. |
| 115 | + |
| 116 | +{{<image filename="images/rc/privatelink-add-connection.png" width="80%" alt="The Add connection section." >}} |
| 117 | + |
| 118 | +Here, choose whether you want to connect to Redis using a **Resource endpoint** or a **Service network**. |
| 119 | + |
| 120 | +{{< multitabs id="privatelink-connection-type" |
| 121 | + tab1="Resource endpoint" |
| 122 | + tab2="Service network" >}} |
| 123 | + |
| 124 | +You can connect with a VPC resource endpoint through the AWS Console or with the AWS CLI. |
| 125 | + |
| 126 | +#### AWS Console |
| 127 | + |
| 128 | +Follow the guide to [create a VPC resource endpoint in the AWS console](https://docs.aws.amazon.com/vpc/latest/privatelink/use-resource-endpoint.html#create-resource-endpoint-aws) with the following settings: |
| 129 | + |
| 130 | +- **Type**: Select **Resources**. |
| 131 | +- **Resource configurations**: Select the configuration with the same Resource Configuration ID as the one shown in the Redis Cloud console. |
| 132 | +- **VPC**: Select your VPC from the list. |
| 133 | +- **Addtional settings**: Select **Enable private DNS name** and set **Private DNS Preference** to **Verified domains only** or **Verified domains and specified domains**. |
| 134 | +- **Subnets**: Select the subnets to create endpoint network resources in. |
| 135 | +- **Security groups**: Select any security groups you want to associate with the resource endpoint, including the security group that allows access to the necessary ports, as described in the [prerequisites](#prerequisites) |
| 136 | + |
| 137 | +#### AWS CLI |
| 138 | + |
| 139 | +To use the AWS CLI to add a VPC resource endpoint, select **Copy** under the **AWS CLI Command** to save the command to your clipboard. Enter the saved command in a terminal shell to create the resource endpoint and replace the following parameters with your own values: |
| 140 | + |
| 141 | +- `<vpc id>`: The ID of your VPC |
| 142 | +- `<subnet ids>`: The IDs of the subnets to create endpoint network resources in |
| 143 | +- `<security group ids>`: The IDs of any security groups you want to associate with the resource endpoint, including the security group that allows access to the necessary ports, as described in the [prerequisites](#prerequisites) |
| 144 | + |
| 145 | +-tab-sep- |
| 146 | + |
| 147 | +You can connect with an existing [VPC lattice service network](https://docs.aws.amazon.com/vpc-lattice/latest/ug/service-networks.html) through the AWS Console or with the AWS CLI. |
| 148 | + |
| 149 | +#### AWS Console |
| 150 | + |
| 151 | +Follow the guide to [Manage resource configuration associations](https://docs.aws.amazon.com/vpc-lattice/latest/ug/service-network-associations.html#service-network-resource-config-association) for your service network. Select the configuration with the same Resource Configuration ID as the one shown in the Redis Cloud console. |
| 152 | + |
| 153 | +#### AWS CLI |
| 154 | + |
| 155 | +To use the AWS CLI to connect to an already existing service network, select **Copy** under the **AWS CLI Command** to save the command to your clipboard. Enter the saved command in a terminal shell to connect to the service network and replace `<service network id>` with the ID of your service network. |
| 156 | + |
| 157 | +{{< /multitabs >}} |
| 158 | + |
| 159 | +## Connect to your database and metrics endpoint with PrivateLink |
| 160 | + |
| 161 | +After you've connected to Redis Cloud with a VPC resource endpoint or a VPC lattice service network, you can find the endpoints for your databases and cluster metrics in the AWS UI by going to the **Associations** tab for your endpoint or service network and viewing the Private DNS entries. You will have one entry for each database and one entry for the metrics endpoint. |
| 162 | + |
| 163 | +{{<image filename="images/rc/privatelink-aws-endpoint-associations.png" width="80%" alt="The Associations tab for a VPC resource endpoint, showing the Private DNS entries for the databases and metrics endpoint." >}} |
| 164 | + |
| 165 | +To view them on Redis Cloud, download the **Discovery script** from the Redis Cloud console and run it in your consumer VPC to discover the database endpoints. |
| 166 | + |
| 167 | +The script returns a list of database endpoints that you can connect to from your consumer VPC. |
| 168 | + |
| 169 | +```json |
| 170 | +[ |
| 171 | + { |
| 172 | + "type": "metrics", |
| 173 | + "dns-entry": "<METRICS DNS ENTRY>", |
| 174 | + "private-dns-entry": "<METRIC PRIVATE DNS ENTRY>", |
| 175 | + "port": 8070 |
| 176 | + }, |
| 177 | + { |
| 178 | + "type": "database", |
| 179 | + "dns-entry": "<DATABASE DNS ENTRY>", |
| 180 | + "private-dns-entry": "<PRIVATE DNS ENTRY>", |
| 181 | + "port": 12345, |
| 182 | + "database_id": 1234567890 |
| 183 | + } |
| 184 | +] |
| 185 | +``` |
| 186 | + |
| 187 | +You can connect to your database by using the database `private-dns-entry` and `port` from your consumer VPC. You can also connect to the metrics endpoint with services like [Prometheus and Grafana]({{< relref "/integrate/prometheus-with-redis-cloud/" >}}) by using the metrics `private-dns-entry` and `port`. |
| 188 | + |
| 189 | +After you've connected to your database, you can view the connection details in the Redis Cloud console in your subscription's **Connectivity > PrivateLink** tab or by going to the [connection wizard]({{< relref "/operate/rc/databases/connect" >}}) for your database. The private endpoint will point to the PrivateLink VPC resource endpoint or service network that you created. |
| 190 | + |
| 191 | +## Disassociate connection |
| 192 | + |
| 193 | +To disassociate a PrivateLink connection: |
| 194 | + |
| 195 | +1. Go to the **Connectivity > PrivateLink** tab in your Redis Cloud subscription. |
| 196 | + |
| 197 | +1. In the **Connections** section, select **Disassociate** button next to the connection you want to disassociate. |
| 198 | + |
| 199 | + {{<image filename="images/rc/privatelink-disassociate-connection.png" width="80%" alt="The Disassociate button next to a VPC endpoint connection." >}} |
| 200 | + |
| 201 | +1. Select **Disassociate VPC endpoint** or **Disassociate service network** to confirm. |
| 202 | + |
| 203 | +After disassociating the connection, you can delete the VPC resource endpoint or service network in the AWS console. |
0 commit comments