Skip to main content

AWS PrivateLink for VeloDB Services

This reference lists the AWS regions supported by VeloDB Services and the Endpoint Service name published in each region. It also explains how to create an interface VPC endpoint, connect it to the published service, and configure private DNS for supported VeloDB hostnames.

For the supported access paths and connection model, see VeloDB Services.

Requirements​

  • The VeloDB hostname and its AWS region. The endpoint service and client VPC must be in this region.
  • An AWS VPC from which clients can access the VeloDB service.
  • Permission to create interface VPC endpoints, security group rules, and Route 53 private DNS records.
  • DNS resolution and DNS hostnames enabled for the VPC.
  • TCP port 443 allowed between clients and the endpoint.

Supported Regions and Endpoint Services​

AWS regionEndpoint service name
us-east-1com.amazonaws.vpce.us-east-1.vpce-svc-0fb96af7d8cd84d4d
us-west-2com.amazonaws.vpce.us-west-2.vpce-svc-0709eceab1c84431a
eu-west-1com.amazonaws.vpce.eu-west-1.vpce-svc-027fb01a146da1e29
eu-central-1com.amazonaws.vpce.eu-central-1.vpce-svc-0b44881fddef6b599
ap-southeast-1com.amazonaws.vpce.ap-southeast-1.vpce-svc-06e619c006c767a35
ap-southeast-7com.amazonaws.vpce.ap-southeast-7.vpce-svc-0378cb9082f6839fd
ap-northeast-1com.amazonaws.vpce.ap-northeast-1.vpce-svc-02a4c77c825111428
ap-south-1com.amazonaws.vpce.ap-south-1.vpce-svc-066b8836d19ee2a95
ap-east-1com.amazonaws.vpce.ap-east-1.vpce-svc-07c3dac48f26cc10a
me-south-1com.amazonaws.vpce.me-south-1.vpce-svc-0f51549e7949898ca
me-central-1com.amazonaws.vpce.me-central-1.vpce-svc-01bb92d635d16039f

Step 1: Create an interface VPC endpoint​

  1. In the AWS Management Console, open VPC > Endpoints.
  2. Select Create endpoint.
  3. Enter a name such as velodb-services.
  4. For Type, select Endpoint services that use NLBs and GWLBs.
  5. Enter the VeloDB Cloud service name for your region.
  6. Select Verify service and confirm that the service name is verified.
  7. Select the VPC used by clients that access the VeloDB service.
  8. Select one or more endpoint subnets.
  9. Attach a security group that allows inbound TCP 443 from the client CIDR ranges or client security groups.
  10. Create the endpoint.

If the state remains Pending acceptance, send the following information to VeloDB Support:

  • VeloDB Cloud organization name
  • VeloDB hostname or hostnames that you plan to route through the endpoint
  • AWS region
  • VPC endpoint ID, for example vpce-0123456789abcdef0

Continue after the endpoint state changes to Available.

Step 2: Configure private DNS​

Record the endpoint's regional DNS name from its Details tab. It resembles:

vpce-xxxxxxxx-yyyyyyyy.vpce-svc-xxxxxxxx.<region>.vpce.amazonaws.com

Then configure Route 53:

  1. Confirm that enableDnsSupport and enableDnsHostnames are enabled for the VPC.

  2. Create or select a Route 53 private hosted zone associated with the client VPC.

  3. If the private zone must cover VeloDB hostnames in multiple AWS regions, use this private hosted zone name:

    aws.velodb.cloud

    You can use a narrower zone such as us-east-1.aws.velodb.cloud if the VPC needs private access in only one region.

warning

A private hosted zone is authoritative for every hostname in its suffix. DNS does not fall back to the public zone when a hostname has no matching private record. If you use aws.velodb.cloud, add records for every VeloDB hostname that clients must resolve, including each warehouse-specific Console hostname. Otherwise, missing hostnames return NXDOMAIN.

  1. Create a CNAME record for each complete VeloDB hostname and point it to the regional VPC endpoint DNS name.

For example, create records for <warehouse-id>-studio.<region>.aws.velodb.cloud when privately accessing a warehouse-specific Console endpoint and apps-api.<region>.aws.velodb.cloud when privately accessing the Metrics API.

Leave the endpoint service's automatic private DNS option disabled unless VeloDB Support explicitly instructs you to enable it.

Step 3: Verify the connection​

From a client in the VPC, resolve each hostname that you configured. For example:

nslookup <warehouse-id>-studio.<region>.aws.velodb.cloud
nslookup apps-api.<region>.aws.velodb.cloud

The DNS chain must resolve to private IP addresses belonging to the endpoint network interfaces.

Verify TLS and HTTP routing with the original VeloDB hostname. Use the request documented for the service that you are accessing. For example:

curl -sS \
  -o /dev/null \
  -w 'remote_ip=%{remote_ip} http_code=%{http_code}\n' \
  https://apps-api.<region>.aws.velodb.cloud/

Confirm that the remote address is private, TLS validation succeeds without --insecure, and the server returns an HTTP response. An unauthenticated request can return 401, 403, or a redirect.

Connect from an on-premises network​

  1. Connect the on-premises network to the endpoint VPC through AWS Direct Connect or VPN.
  2. Ensure that routes and security rules allow access to the endpoint network interfaces on TCP 443.
  3. Configure corporate DNS to forward the regional VeloDB Cloud private zone to Route 53 Resolver.

Troubleshooting​

ProblemChecks
Service name cannot be verifiedConfirm that the VPC region matches the service name and that the endpoint type is Interface.
Endpoint remains pendingAsk VeloDB Support to approve the VPC endpoint ID.
VeloDB hostname resolves publiclyCheck the private hosted zone name, VPC association, record name, and DNS forwarding.
Connection times outCheck the endpoint state, security group, network ACL, routes, and TCP 443 access.
TLS validation failsUse the original VeloDB hostname, not the VPC endpoint DNS name or private IP.