Skip to main content

Configure private connectivity to the per-warehouse Console endpoint on AWS

This guide explains how to use AWS PrivateLink to access the per-warehouse Console endpoint privately from your AWS VPC, without traversing the public internet.

For an overview of the connection model and its requirements, see Private connectivity to the per-warehouse Console endpoint.

Requirements​

  • The console hostname and its AWS region.
  • An AWS VPC that can be reached by users of the per-warehouse Console tools.
  • Permission to create interface VPC endpoints, security group rules, and Route 53 private DNS records.
  • DNS resolution and DNS hostnames enabled for the VPC.
  • TCP port 443 allowed between clients and the endpoint.

For production environments, use endpoint subnets in multiple availability zones when available.

Regional endpoint services​

AWS regionEndpoint service name
us-east-1com.amazonaws.vpce.us-east-1.vpce-svc-0fb96af7d8cd84d4d
us-west-2com.amazonaws.vpce.us-west-2.vpce-svc-0709eceab1c84431a
eu-west-1com.amazonaws.vpce.eu-west-1.vpce-svc-027fb01a146da1e29
eu-central-1com.amazonaws.vpce.eu-central-1.vpce-svc-0b44881fddef6b599
ap-southeast-1com.amazonaws.vpce.ap-southeast-1.vpce-svc-06e619c006c767a35
ap-southeast-7com.amazonaws.vpce.ap-southeast-7.vpce-svc-0378cb9082f6839fd
ap-northeast-1com.amazonaws.vpce.ap-northeast-1.vpce-svc-02a4c77c825111428
ap-south-1com.amazonaws.vpce.ap-south-1.vpce-svc-066b8836d19ee2a95
ap-east-1com.amazonaws.vpce.ap-east-1.vpce-svc-07c3dac48f26cc10a
me-south-1com.amazonaws.vpce.me-south-1.vpce-svc-0f51549e7949898ca
me-central-1com.amazonaws.vpce.me-central-1.vpce-svc-01bb92d635d16039f

Step 1: Create an interface VPC endpoint​

  1. In the AWS Management Console, open VPC > Endpoints.
  2. Select Create endpoint.
  3. Enter a name such as velodb-studio.
  4. For Type, select Endpoint services that use NLBs and GWLBs.
  5. Enter the VeloDB Cloud service name for your region.
  6. Select Verify service and confirm that the service name is verified.
  7. Select the VPC used by clients of the per-warehouse Console tools.
  8. Select one or more endpoint subnets.
  9. Attach a security group that allows inbound TCP 443 from the client CIDR ranges or client security groups.
  10. Create the endpoint.

If the state remains Pending acceptance, send the following information to VeloDB Support:

  • VeloDB Cloud organization name
  • Console hostname
  • AWS region
  • VPC endpoint ID, for example vpce-0123456789abcdef0

Continue after the endpoint state changes to Available.

Step 2: Configure private DNS​

Record the endpoint's regional DNS name from its Details tab. It resembles:

vpce-xxxxxxxx-yyyyyyyy.vpce-svc-xxxxxxxx.<region>.vpce.amazonaws.com

Then configure Route 53:

  1. Confirm that enableDnsSupport and enableDnsHostnames are enabled for the VPC.

  2. Create or select a Route 53 private hosted zone associated with the client VPC.

  3. Use the most specific practical zone name. For example:

    us-east-1.aws.velodb.cloud

  4. Create a CNAME record for the complete console hostname and point it to the regional VPC endpoint DNS name.

Example:

RecordTypeValue
awvadbgl-studio.us-east-1.aws.velodb.cloudCNAMERegional VPC endpoint DNS name

The private hosted zone is authoritative for the entire regional suffix inside its associated VPCs. Route 53 does not fall back to public DNS when a hostname under that suffix has no matching private record. Add a CNAME record for every per-warehouse Console hostname in the region that clients need to resolve. Otherwise, hostnames for other warehouses in the same region can return NXDOMAIN.

Leave the endpoint service's automatic private DNS option disabled unless VeloDB Support explicitly instructs you to enable it.

Step 3: Verify the connection​

From a client in the VPC, run:

nslookup awvadbgl-studio.us-east-1.aws.velodb.cloud

The DNS chain must resolve to private IP addresses belonging to the endpoint network interfaces.

Verify TLS and HTTP routing:

curl -sS \
  -o /dev/null \
  -w 'remote_ip=%{remote_ip} http_code=%{http_code}\n' \
  https://awvadbgl-studio.us-east-1.aws.velodb.cloud/webui_api/api/data/catalogs

Confirm that the remote address is private, TLS validation succeeds without --insecure, and the server returns an HTTP response. An unauthenticated request can return 401, 403, or a redirect.

Finally, open the warehouse in the VeloDB Console from an authenticated browser and use one of the covered tools, such as running a query in SQL Editor.

Connect from an on-premises network​

  1. Connect the on-premises network to the endpoint VPC through AWS Direct Connect or VPN.
  2. Ensure that routes and security rules allow access to the endpoint network interfaces on TCP 443.
  3. Configure corporate DNS to forward the regional VeloDB Cloud private zone to Route 53 Resolver.

Troubleshooting​

ProblemChecks
Service name cannot be verifiedConfirm that the VPC region matches the service name and that the endpoint type is Interface.
Endpoint remains pendingAsk VeloDB Support to approve the VPC endpoint ID.
Console hostname resolves publiclyCheck the private hosted zone name, VPC association, record name, and DNS forwarding.
Connection times outCheck the endpoint state, security group, network ACL, routes, and TCP 443 access.
TLS validation failsUse the original console hostname, not the VPC endpoint DNS name or private IP.