ApsaraMQ for RabbitMQ:Accessing via PrivateLink endpoints

Scenarios

PrivateLink endpoints are useful for accessing ApsaraMQ for RabbitMQ from a specified VPC in the following scenarios:

• Instance-based products require network link fencing for network access.

• Cloud networks and cross-region networks are built by using Cloud Enterprise Network (CEN).

• Routing rules cannot be used to access cloud products in a CEN network.

• SLB alternative for secure access: ApsaraMQ for RabbitMQ does not support mounting a Server Load Balancer (SLB) instance for traffic forwarding, nor does it support access over the "Internet > SLB > RabbitMQ" path. To achieve secure access within a VPC or avoid Internet exposure, use PrivateLink to bind the instance to a VPC.

• Cross-data-center or external access: Use PrivateLink combined with Express Connect or VPN Gateway to connect on-premises networks with cloud VPCs.

After you create a PrivateLink endpoint, the original VPC endpoint remains available for accessing the ApsaraMQ for RabbitMQ service.

Billing

ApsaraMQ for RabbitMQ creates and hosts the PrivateLink endpoint for you at no additional charge. However, the PrivateLink service charges hourly fees to the Alibaba Cloud account that enabled it, including instance fees and data transfer fees. For more information, see Billing.

A PrivateLink endpoint is bound to its associated RabbitMQ instance. You cannot manually delete the endpoint in the PrivateLink console. When the RabbitMQ instance expires or is manually deleted, the ApsaraMQ for RabbitMQ service automatically deletes the PrivateLink endpoint.

Region availability

This feature is available in the following regions: China (Hangzhou), China (Shanghai), China (Beijing), China (Zhangjiakou), China (Shenzhen), China (Guangzhou), China (Chengdu), China (Ulanqab), Singapore, Germany (Frankfurt), US (Silicon Valley), Indonesia (Jakarta), Malaysia (Kuala Lumpur), China (Hong Kong), SAU (Riyadh - Partner Region), Philippines (Manila), and Thailand (Bangkok).

Procedure

1. Log on to the ApsaraMQ for RabbitMQ console. In the left-side navigation pane, click Instances.

2. In the top navigation bar of the Instances page, select the region where the instance that you want to manage resides. Then, in the instance list, click the name of the instance that you want to manage.

3. On the Instances page, click the Endpoint Information tab. In the Terminal Endpoint section, find the Endpoint column and click Create PrivateLink Endpoint.

4. In the Create PrivateLink Endpoint panel, perform the following steps.

   1. Create a service-linked role. For more information, see Service-linked Role.

   2. Enable the PrivateLink service.

   3. Configure the following parameters. Then, click OK.

      Important

      After a PrivateLink endpoint is created, it cannot be modified or deleted. Ensure that you enter the correct information.

      Parameter	Description	Example
      VPC ID	Select a VPC ID. The VPC must be in the Available state.	vpc-degu45gufksifgiuf****
      VSwitch ID	Select vSwitch IDs. To ensure high availability, select vSwitches in at least two zones. Note When you select zones, make sure that Network Load Balancer (NLB) instances can be created in the selected zones. You can query the supported zones or check the supported zones in the NLB console. The vSwitches must be in the Available state and have more than 20 available IP addresses.	vsw-bewhf9uiagudie**** vsw-feuo8evyidochhe****
      Security Group	Select a security group. Configure port rules as follows: Basic rule: You must allow inbound TCP traffic on ports 5672 and 5671. ACK cluster scenario: If you use an internal connection, the security group must allow the CIDR block of ACK cluster Pods. Alternatively, you can use the VPC whitelist feature to authorize access from the ACK VPC directly. ECS scenario: If ApsaraMQ for RabbitMQ and ECS share the same security group, ensure that the security group allows inbound TCP traffic on port 5672. Managed security groups are not supported.	sg-uoefguo8fvyeif****

      Important

      After a PrivateLink endpoint is created, you cannot modify the security group on your own.

      • Reason: Managed protection is enabled by default when the endpoint is created, and the endpoint is hosted by the service.

      • Workaround: You cannot modify the security group in the console. If you need to change it, contact the ApsaraMQ for RabbitMQ service team for assistance.

      After the instance is created, you can view the endpoint details on the Endpoint Information tab of the Instance Details page.

5. After you obtain the PrivateLink endpoint, configure it in your software development kit (SDK) code to send and receive messages over the private connection. For more information, see Step 3: Use an SDK to send and receive messages.

Service-linked Role

• The first time you use a PrivateLink endpoint, you must create the service-linked role AliyunServiceRoleForAmqpNetwork. Before you create the role, grant the required permissions to your account. You can attach the AliyunAMQPFullAccess system policy. If you use a custom policy, grant the following permissions. In the policy, replace ${accountid} with your Alibaba Cloud account ID.

  {
      "Statement": [
          {
              "Action": [
                  "ram:CreateServiceLinkedRole"
              ],
              "Resource": "acs:ram:*:${accountid}:role/*",
              "Effect": "Allow",
              "Condition": {
                "StringEquals": {
                "ram:ServiceName": [
                  "network.amqp.aliyuncs.com"
                ]
                }
              }
          }
      ],
      "Version": "1"
  }

• Policy name: AliyunServiceRolePolicyForAmqpNetwork

• Allows ApsaraMQ for RabbitMQ to use this role to access your PrivateLink service and perform VPC-related operations.

• For more information, see Service-linked roles.

References

For more information about PrivateLink, see What is PrivateLink?.

FAQ