Private access establishes secure and stable private connections between a VPC and services on Alibaba Cloud. It offers flexible configurations to meet various application requirements. This topic describes VPC private connection configuration.
Background information
Configuring a private connection for a Compute Nest service offers the following benefits:
Private communication: Network traffic is routed within the Alibaba Cloud internal network instead of the public internet. This helps avoid the security risks of public network access.
Enhanced security and control: You can add security group rules to the elastic network interface used for service access within the VPC, for stronger security and control.
Low latency and high quality: Alibaba Cloud networking provides low-latency, highly available connections.
Cross-zone and cross-region access: The connection modes in Compute Nest support private access to services within the same zone, across different zones, and across different regions.
Simplified access: You can use an SLB or a service node IP address as a static or dynamic resource to provide private access. This offers users more flexibility for quick integration.
Simple management: Flexible cross-account and cross-VPC service access helps you avoid complex routing and security configurations.
In Compute Nest, only fully managed services support a VPC private connection. After creating a service instance, users receive a domain name from the service provider to access the software.
If the provider's fully managed service does not have a private connection enabled, users must access the service over the internet through its public domain name.
If the provider's fully managed service has a private connection enabled, users receive an internal domain name and can access it through the private connection. In this scenario, the service provider shares the service from their VPC with the customer's VPC, enabling private communication across VPCs.
VPC private access parameters
When creating a service, the service provider can configure private connection settings in the Network Settings section of the Compute Nest console.
The following table describes the parameters for configuring private access for a Compute Nest fully managed service.
Parameter | Description |
VPC private access | Enables or disables the private connection feature. |
Connection mode | After you enable a private connection, you must select a connection mode. Compute Nest private access supports two modes: PrivateLink and VPC Peering. You can choose the mode that suits your needs.
|
Payer Note This option is available only when you select SLB instance in PrivateLink mode. | Specifies the party that pays for the SLB instance. By default, the service provider is not available as a payer option. To use this feature, log on to the Quota Center console. On the Privileges page, enter the quota ID |
Custom domain name | (Optional) If you specify a custom domain name, it is recommended to users when they create a service instance for private access. If you leave this blank, no custom domain name is recommended. |
Manage private connections for service instances
On the service instance details page, click the Network Settings tab to view private connection configuration details.
Basic information: Displays the basic information of the endpoint service instance. You can click the link in the endpoint service instance ID to go to the PrivateLink console. From there, you can create or delete service resources, manage endpoint connections, manage account IDs in the service whitelist, and view monitoring data. For more information about how to manage the service whitelist, see Add and manage a service whitelist.
Zone and network interface: Displays information about the user's vSwitch used to create the private connection.
Security group: Displays information about the user's security group used to create the private connection.
