Access Alibaba Cloud services - PrivateLink - Alibaba Cloud Documentation Center

Create an endpoint in a VPC and specify an Alibaba Cloud service. Requests sent to the endpoint will be forwarded by PrivateLink to the target service, enabling secure private network access and avoiding the potential security risks of accessing services over the public internet.

Users can use interface endpoints to access Alibaba Cloud services over the private network.
After user authorization, Alibaba Cloud services can use reverse endpoints to securely access specified resources in the user's VPC over the private network.

Use interface endpoints to access Alibaba Cloud services in the same region

Service consumers can create interface endpoints in a VPC to access specified Alibaba Cloud services over the private network.

The system creates elastic network interfaces for the endpoint's availability zones and assigns private IP addresses from the corresponding vSwitch CIDR blocks to these ENIs.
Service consumers can use the endpoint domain name or endpoint zone domain name to access Alibaba Cloud services. All service requests sent to the endpoint will be forwarded to backend service resources through PrivateLink.
The endpoint domain name and endpoint zone domain name are public DNS authoritative domain names, which can be resolved by clients in other VPCs and on-premises data centers.
- You can use Enable cross-region endpoints to directly connect to Alibaba Cloud services across regions.
- Other VPCs and on-premises data centers can also access Alibaba Cloud services through interface endpoints in the VPC after establishing network connections with the VPC.

When an Alibaba Cloud service is configured with a custom service domain name, users can enable custom service domain name for the interface endpoint to access the corresponding Alibaba Cloud service using the custom service domain name.

Create/Delete interface endpoints

Supported scope: Alibaba Cloud services that support access through interface endpoints.
Ensure that PrivateLink service is activated, and that a VPC and vSwitch and security group have been created in the target region.

Console

Go to the Endpoints - Create Endpoint page.
Configure the interface endpoint:
- Basic Settings：
  - Region: Select the region where the Alibaba Cloud service access entry is located.
  - Name and description: Uniformly identify cloud resources.
- Type: Select Alibaba Cloud Service.
- Available Services: Select the Alibaba Cloud service to access based on the endpoint service name.
  Available: The Alibaba Cloud service has been deployed in the region, and the service consumer has the permissions to connect to the corresponding Alibaba Cloud service.
- Network Settings：
  - To ensure high service availability, we recommend selecting vSwitches in at least two availability zones. You can specify IP addresses from the vSwitch for the elastic network interfaces in the endpoint's availability zones. If not specified, the system will assign them automatically.
    You are not allowed to specify the System reserved IP addresses of the vSwitch for the elastic network interface.
  - IP Version: When the Alibaba Cloud service supports dual-stack, you can select dual-stack, allowing clients to access the service using both IPv4 and IPv6 addresses. Otherwise, only IPv4 can be selected.
- Security Group: Associated with the interface endpoint, controlling inbound traffic to the elastic network interfaces across all endpoint availability zones.
- Advanced Settings：
  - Enable Custom Domain Name?: When the Alibaba Cloud service supports access through a custom service domain name, the service consumer can enable this option to access Alibaba Cloud services using a custom domain name.
  - Enable Zone Affinity: When the Alibaba Cloud service supports same-AZ priority, the service consumer can enable/disable same-AZ priority.
    - When enabled, the service consumer accesses the service using the endpoint domain name from the availability zone where the interface endpoint is located. The Cloud Resolution DNS system will preferentially return the elastic network interface IP of the corresponding endpoint availability zone, thereby enabling locality-based access.
    - If accessing from an availability zone other than where the interface endpoint is located, or when same-AZ priority is disabled, the Cloud Resolution DNS system will return all available elastic network interface IPs across all endpoint availability zones.
  - Endpoint policy: Keep Default endpoint policy, which allows full access. Whether Custom endpoint policy can be configured is determined by the accessed Alibaba Cloud service.

After creation, you can use an ECS instance in the same VPC to run the following commands to test connectivity.

ping <IP of the elastic network interface in the endpoint availability zone>
# You can view the IP address of the elastic network interface on the Availability Zones and ENIs tab on the instance details page
# For HTTP/HTTPS services, we recommend directly accessing the service port
curl -sI http://<endpoint domain name>
# You can view the endpoint domain name on the instance list page
# The security group inbound rules must open HTTP (80) and HTTPS (443) ports for the VPC where the endpoint is located to access the service through HTTP or HTTPS.
# Whether HTTPS can be used for access is determined by the corresponding service.

API

Call CreateVpcEndpoint to create an interface endpoint.

Configure high availability for interface endpoints

When an interface endpoint is configured with multiple availability zones and users access Alibaba Cloud services using the endpoint domain name, Alibaba Cloud provides a fully managed availability probing capability to ensure quick failover to other availability zones when an AZ failure occurs:

Failover: The system probes the availability of elastic network interface IPs across different endpoint availability zones in real time. If an exception is detected, the corresponding DNS record is removed to prevent traffic from flowing to the failed availability zone.
Recovery: After the failure is resolved, the system automatically adds the corresponding DNS record back.

Console

Configure multiple availability zones

When creating an interface endpoint, select vSwitches in at least two availability zones.
After creation, click the target interface endpoint ID. On the Zone and ENI tab, click Add Zone.
Click Delete in the Actions column of the target availability zone to remove the corresponding availability zone from the service.

After configuration, on the Zone and ENI tab, you can view the corresponding Zone Domain and the IP Address of the elastic network interface in the endpoint availability zone.

To ensure high service availability, use the endpoint domain name to access the service. Endpoint Domain can be viewed on the interface endpoint list page.

API

Call AddZoneToVpcEndpoint to add availability zones to the endpoint.
Call RemoveZoneFromVpcEndpoint to remove availability zones from the endpoint.

Same-AZ locality-based access

When the Alibaba Cloud service supports same-AZ priority, the service consumer can enable/disable same-AZ priority. When enabled:

When enabled, the service consumer accesses the service using the endpoint domain name from the availability zone where the interface endpoint is located. The Cloud Resolution DNS system will preferentially return the elastic network interface IP of the corresponding endpoint availability zone, thereby enabling locality-based access.
If accessing from an availability zone other than where the interface endpoint is located, or when same-AZ priority is disabled, the Cloud Resolution DNS system will return all available elastic network interface IPs across all endpoint availability zones.

When the Alibaba Cloud service's support for same-AZ priority changes:

The Alibaba Cloud service changes from supporting to not supporting same-AZ priority:
- When creating an interface endpoint, the service consumer cannot enable same-AZ priority.
- For existing interface endpoints:
  - Same-AZ priority is disabled: The current status is not affected, but it cannot be enabled.
  - Same-AZ priority is enabled: The current status is not affected, and it can be disabled.
The Alibaba Cloud service changes from not supporting to supporting same-AZ priority:
- When creating an interface endpoint, the service consumer can enable/disable same-AZ priority.
- For existing interface endpoints: The current status is not affected, and same-AZ priority can be enabled/disabled.

Console

Enable/Disable same-AZ priority

When creating an interface endpoint, configure Enable Zone Affinity.
After creation, click the target interface endpoint ID. In the Basic Information tab, adjust Enable/Disable on the right side of Enable Zone Affinity.

API

During creation: Call CreateVpcEndpoint and configure ZoneAffinityEnabled.
After creation: Call UpdateVpcEndpointAttribute to adjust ZoneAffinityEnabled.

Secure PrivateLink

PrivateLink provides three levels of access control: security groups, network ACLs, and endpoint policies. They can be used individually or in combination to achieve granular security management.

Security groups: Apply to the elastic network interfaces across all endpoint availability zones, controlling traffic from resources in the VPC to the interface endpoint.
- When creating an interface endpoint, you must select a custom security group. After creation, you can add/remove security groups, but ensure at least one security group is retained.
- When creating an interface endpoint, PrivateLink creates a managed security group by default. The outbound rules allow all traffic by default: it includes a rule with priority 1 that allows all traffic to any IPv4/IPv6 address.
  - Managed security groups can be viewed on the ECS console - Security Groups page.
  - Managed security groups cannot be modified or deleted, but they consume the security group quota q_security-groups (the maximum number of security groups an account can own).
- If you add an outbound deny rule with priority 1 to a custom security group, since deny rules with the same priority take precedence over allow rules, it may cause the service to become inaccessible. Please configure outbound deny rules with caution.
Network ACLs: Control traffic to and from the vSwitch where the elastic network interface of the endpoint availability zone is located.
Endpoint policy: When using interface endpoints to access Alibaba Cloud services, you can configure an Endpoint policies.
- Alibaba Cloud services that support access through interface endpoints all support configuring a default endpoint policy, granting full access to the interface endpoint.
- Currently, only Object Storage Service (OSS) and PAI - AI WorkSpace support configuring custom endpoint policies to restrict specific users' access to specific resources.

Console

Configure security groups

When configuring an interface endpoint, you specify the security groups to join. After creation, you can add/remove security groups.

Add a security group: On the target endpoint details page, on the Security Group tab, click Join Security Group.
Remove a security group: Click Delete in the Actions column of the joined security group.

Only client traffic that complies with the rules of the joined security groups can access Alibaba Cloud services through the interface endpoint. You can refer to the following security group rule configurations:

Inbound: Add only rules that allow access from specified IP addresses. Clients other than the specified IPs cannot access Alibaba Cloud services through the endpoint.
Outbound: All access is allowed by default, meaning ECS instances in the security group can access external resources.

Configure network ACL

Go to the VPC console - Network ACL page. After selecting the target region at the top of the page, click Create Network ACL.
Configure VPC and select the VPC to which the interface endpoint belongs.
Click the instance ID or Manage in the Actions column to enter the Associated Resources tab. Click Associate vSwitch, select the target vSwitch to which the interface endpoint belongs, and click OK. The associated vSwitch will control inbound and outbound traffic according to network ACL rules.
To remove the control, after binding, on the same tab, click Unbind in the Actions column of the target vSwitch.
On the target network ACL's Inbound Rules/Outbound Rules tab, click Manage Inbound Rule/Manage Outbound Rule. After matching a network ACL rule based on Protocol, IP Version, Source IP Address/Destination IP Address, and Source Port Range, the system will apply the specified Policy to the traffic, allowing/denying the corresponding traffic.

Configure endpoint policy

You can configure an endpoint policy when accessing Alibaba Cloud services. After creation, on the target interface endpoint details page, under the Endpoint Policy tab, click Edit to modify it.

API

Call AttachSecurityGroupToVpcEndpoint to add the endpoint to a security group.
Call DetachSecurityGroupFromVpcEndpoint to remove the endpoint from a security group.
When calling CreateVpcEndpoint or UpdateVpcEndpointAttribute, pass in PolicyDocument to configure the endpoint policy.

Access using a custom service domain name

When accessing Alibaba Cloud services in a VPC, you typically use a specific service domain name. If the service has a custom service domain name configured, you can enable the custom service domain name for the interface endpoint you created. After enabling, you can continue using the domain name to access the service through PrivateLink over the private network without modifying the service address in your applications.

The scope of the custom service domain name is the VPC where the interface endpoint is located. Only the VPC where the interface endpoint is located can resolve the private IP. After other VPCs and on-premises data centers establish connectivity with the VPC where the interface endpoint is located and configure DNS resolution, they can use the custom service domain name to access the service.

The same custom service domain name cannot be enabled by multiple interface endpoints in the same VPC simultaneously. The first interface endpoint that enables it takes effect, and other interface endpoints cannot enable it.

Only after the Alibaba Cloud service configures and verifies the custom service domain name for the endpoint service can users enable the custom service domain name for the interface endpoint.

The custom service domain name is resolved by PrivateZone hosted by PrivateLink.

Enable a custom service domain name for an interface endpoint

When creating an interface endpoint, set Enable Custom Domain Name? to Enable.
After creation, in the Domain Name of Endpoint Service area on the interface endpoint details page, turn on the Custom Domain Name switch.
When no longer needed, you can turn it off here.

Access services using a custom service domain name

Same-VPC access: Within the VPC where the interface endpoint is located, you can directly use the custom service domain name to access the service without additional configuration.
Cross-VPC access:
1. Network connectivity: Refer to VPC interconnection solutions and select VPC peering or Cloud Enterprise Network (CEN) to connect the VPCs.
2. Configure DNS resolution:
  1. Go to the Private DNS console. Click Add Zone, configure the custom service domain name, set the domain name scope to Alibaba Cloud VPC intranet, and select the target VPC.
  2. Click the domain name ID. On the Settings tab, select Add Record and add a CNAME record with the domain prefix @ and the record value set to the default service domain name.
On-premises data center access
1. Network connectivity: Refer to VPC-to-on-premises IDC connection solutions and select Express Connect or VPN Gateway to connect to the on-premises data center.
2. Configure DNS resolution:
  1. Go to the Private DNS console. Click Add Inbound Endpoint, and configure Inbound VPC as the VPC where the interface endpoint is located. To ensure high availability, select at least two availability zones for the inbound traffic service IP addresses.
  2. Configure a forwarder zone in the on-premises data center.
    This document uses BIND as an example. If the on-premises IDC uses another DNS system, refer to its documentation to configure conditional forwarding. The configuration principle is the same: forward DNS resolution requests for specific domain names to the service IP address of the VPC PrivateZone inbound endpoint.
    1. Configure the BIND file.
      The location of the BIND configuration file varies by operating system. Common paths are /etc/named.conf and /etc/bind/named.conf.
```
// Example: Accessing the pai-dlc service. The zone is configured as the corresponding custom service domain name
zone "pai-dlc-vpc.cn-beijing.aliyuncs.com" IN {
       type forward;
       forwarders {
           10.0.0.173; // Replace with the inbound traffic service IP address
           10.0.1.109;
       };
   };
```
    2. Restart the BIND service to apply the configuration.
      The command to restart the BIND service varies by operating system. A common command is systemctl restart named.

Disconnect

When you no longer need to access Alibaba Cloud services, the service consumer can delete the interface endpoint. Deletion will terminate the endpoint connection to the service and is irreversible. Please proceed with caution.

Console

In the Actions column of the target interface endpoint, click Delete. After deletion, the VPC to which the interface endpoint belongs will no longer be able to access the corresponding Alibaba Cloud service through PrivateLink. During deletion, you can select Delete the endpoint zone to also delete the elastic network interfaces in the endpoint availability zones.

API

Call DeleteVpcEndpoint to delete the interface endpoint.

If managed protection was enabled when the endpoint was created (the ProtectedEnabled parameter is set to true, only effective for STS calls), only the STS identity used during creation can perform deletion or modification operations. To delete it, call the DeleteVpcEndpoint API using the same STS identity used during creation.

Some endpoints automatically created by Alibaba Cloud services are managed by the service provider, such as the Serverless instances of Cloud Message Queue for Apache RocketMQ. Such endpoints cannot be deleted through the console or by calling the DeleteVpcEndpoint API, and the operation will return an EndpointProtected error. To delete it, release the corresponding service instance, and the endpoint will be cleaned up by the service provider.

Use interface endpoints to access Alibaba Cloud services across regions

You can create an interface endpoint and enable cross-region endpoints to connect to Alibaba Cloud services across regions through PrivateLink.

Currently, the Alibaba Cloud services that support cross-region connections include Bailian - Alibaba Cloud's Large Language Model Platform. Other Alibaba Cloud services are being continuously added. To connect to other Alibaba Cloud services across regions, you can submit a ticket or contact your account manager.

After the service consumer enables cross-region endpoints and selects the service region, the system will automatically display the available Alibaba Cloud services in that region.
Available: The Alibaba Cloud service has been deployed in the selected service region, and the supported regions include the region where your endpoint is located.
If you still cannot select the corresponding service when creating an endpoint, contact the service provider to confirm that your account has been added to the service whitelist.
The service consumer can use the endpoint domain name to access the service. When connecting to Alibaba Cloud services across regions, the system no longer generates endpoint zone domain names to ensure that applications can leverage PrivateLink's fully managed availability probing capability for quick failover to other availability zones when an AZ failure occurs.
We recommend creating interface endpoints in at least two availability zones to achieve high availability.

When an Alibaba Cloud service is configured with a custom service domain name, users can enable custom service domain name for the interface endpoint to access the corresponding Alibaba Cloud service using the custom service domain name.

Console

Go to the Endpoints - Create Endpoint page.
Configure the interface endpoint:
- Region: Select the region where the Alibaba Cloud service access entry is located.
- Type: Select Alibaba Cloud Service.
- Service Settings: Select the Enable inter-region endpoint checkbox and choose the Service Region.
  If you enable cross-region endpoints to connect between the Chinese mainland and regions outside the Chinese mainland, you must first complete Enterprise identity verification.
  If you enable cross-region endpoints to connect between the Chinese mainland and regions outside the Chinese mainland, read the cross-border data transfer compliance commitment and select I have read and agree to the compliance commitments above..
- Available Services: From the list of Alibaba Cloud services supported in the service region, select the target service by its endpoint service name.
- Inter-Region Bandwidth Configuration:
  - Billing Method: Billed by CDT. Cross-region traffic fees are uniformly billed by CDT. For the complete billing items, refer to Cross-region PrivateLink.
  - Bandwidth:
    - For interconnection between regions within the Chinese mainland, the default maximum cross-region bandwidth is 1000 Mbps, which can be adjusted via the quota pvl_quota_cross_region_ep_max_bandwidth_payg_china.
    - For interconnection between regions outside the Chinese mainland, the default maximum cross-region bandwidth is 100 Mbps, which can be adjusted via the quota pvl_quota_cross_region_ep_max_bandwidth_payg_oversea.
    - For interconnection between the Chinese mainland and regions outside the Chinese mainland, the default maximum cross-region bandwidth is 100 Mbps, which can be adjusted via the quota pvl_quota_cross_region_ep_max_bandwidth_payg_cross_border.
- For other configurations, refer to Create/Delete interface endpoints.

API

Call CreateVpcEndpoint to create an interface endpoint.

Alibaba Cloud services use reverse endpoints to access user-authorized resources

After user authorization, Alibaba Cloud services can use reverse endpoints to securely access specified resources in the user's VPC over the private network. Users can further control the scope of resources accessible to Alibaba Cloud services through security groups and network ACLs.

Security groups apply to the elastic network interfaces across all endpoint availability zones, controlling traffic from the reverse endpoint to resources in the VPC.
After creating a reverse endpoint, PrivateLink creates a managed security group by default. The inbound rules allow all traffic by default: it includes a rule with priority 1 that allows all traffic from any IPv4/IPv6 address.
- Managed security groups can be viewed on the ECS console - Security Groups page.
- Managed security groups cannot be modified or deleted, but they consume the security group quota q_security-groups (the maximum number of security groups an account can own).

Supported scope: Alibaba Cloud services that support access through reverse endpoints.

Ensure that PrivateLink service is activated, and that a VPC and vSwitch and security group have been created in the target region.

Reverse endpoints do not support dual-stack access.

Console

Create a reverse endpoint

Go to the Endpoints - Create Endpoint page.
Configure the reverse endpoint:
- Basic Settings：
  - Region: Select the region where the resources accessed by the Alibaba Cloud service are located.
  - Endpoint Type: Select reverse endpoint.
  - Name and description: Uniformly identify cloud resources.
- Type: Select Alibaba Cloud Service.
- Available Services: Select the Alibaba Cloud service to access based on the endpoint service name.
- Network Settings: To ensure high service availability, we recommend selecting vSwitches in at least two availability zones. You can specify IP addresses from the vSwitch for the elastic network interfaces in the endpoint's availability zones. If not specified, the system will assign them automatically.
- Security Group: Apply to the elastic network interfaces across all endpoint availability zones. Reverse endpoints only allow Alibaba Cloud services to proactively access user resources.

Delete a reverse endpoint

In the Actions column of the target reverse endpoint, click Delete. After deletion, the corresponding Alibaba Cloud service will no longer be able to access the specified resources in the user's VPC through the reverse endpoint.

API

Call CreateVpcEndpoint to create a reverse endpoint.
Call DeleteVpcEndpoint to delete a reverse endpoint.

More information

Differences from gateway endpoints

Gateway endpoints do not depend on PrivateLink and only support accessing a limited number of Alibaba Cloud services.

Feature	Gateway endpoint	PrivateLink
Use cases	Use endpoint policies together with OSS bucket policies to reduce the risk of unauthorized access and implement bidirectional authentication: Source control: The VPC can access only specified buckets. Destination control: The OSS bucket is accessible only from specified VPCs.	A standard solution for private access from a VPC to Alibaba Cloud services. Supports more service types and advanced capabilities than gateway endpoints.
Supported service types	Currently supports only OSS.	Supports many Alibaba Cloud services and user-created services, including services provided by ISVs.
VPC security capabilities	Supports only endpoint policies.	Supports security groups, network ACLs, and endpoint policies.
Networking capabilities	Does not support complex networking. May conflict with Alibaba Cloud service CIDR blocks (100.x.x.x/8).	Supports complex networking. Compatible with VPC peering, CEN, Express Connect, and VPN gateways for cross-region and hybrid cloud connectivity.
O&M capabilities	None	Supports flow logs for auditing and troubleshooting.
Fees	Free of charge.	Charges include instance fees and data transfer fees. For user-created services, you choose whether the consumer or provider pays.