The AI Registry console is accessible directly through a web browser and requires no additional network configuration. When your application accesses AI Registry through a client software development kit (SDK) or API, for example to pull prompts and other resources at runtime, choose public network access or VPC private network access based on your deployment environment.
This topic describes the VPC private network access method: connect the VPC of your application to AI Registry through PrivateLink. PrivateLink establishes a secure private connection between your VPC and AI Registry. All access traffic stays on the Alibaba Cloud internal network, which ensures data security.
If your application runs on-premises, in an IDC, or in an environment that is not associated with a VPC, seeConfigure Public Network Access for AI Registry to configure a public endpoint and an IP address whitelist.
Public network access does not require a PrivateLink endpoint. This topic applies only to VPC private network access.
Prerequisites
You have an Alibaba Cloud account and have activated AI Registry.
The VPC and the vSwitch that host your application are created. The VPC must be in the same region as the AI Registry instance. If you have not created them, see Create a VPC and a vSwitch.
A security group is created. If you have not created one, see Security groups.
Associate a VPC with AI Registry
AI Registry provides two methods to configure VPC private network access through PrivateLink. Method 1 is recommended: the system creates and configures the PrivateLink endpoint automatically. Use Method 2 if you prefer to manage the endpoint manually in the VPC console.
Method 1 (recommended): Associate a VPC from the AI Registry console
Associate a VPC with one click in the AI Registry console. The system configures the PrivateLink endpoint automatically, so you do not need to use the VPC console.
Log on to the MSE console. In the left-side navigation pane, choose AI Registry > Access Management.
In the VPC Access section, click + Associate VPC in the upper-right corner.
Configure the following parameters:
| Configuration item | Description |
| Select VPC | Select the VPC that you want to connect. |
| Zone and vSwitch | Select a zone in the VPC and the corresponding vSwitch. Click + Add vSwitch to configure multiple vSwitches. We recommend that you select at least two zones for high availability (HA). |
| Security Group | Select a security group that allows access from within the VPC. |
| Description | Optional. Enter a description that helps you identify this access record. |
Click Confirm Association. The system automatically creates a VPC endpoint and configures a custom service domain name. This usually takes 1 to 2 minutes. When the status changes to Available, the access configuration is complete. The private network domain name of the current region, in the format
airegistry.{region-id}.mse.aliyuncs.com, such asairegistry.cn-hangzhou.mse.aliyuncs.comfor the China (Hangzhou) region, then appears at the top of the VPC Access section.
Method 2: Manually create an endpoint
If you prefer to manage network resources manually in the VPC console, configure PrivateLink as follows.
Log on to the VPC console. In the left-side navigation pane, choose Endpoints.
Click Create Endpoint. If this is your first time using PrivateLink, follow the on-screen instructions to activate the service.
Configure the following parameters:
| Configuration item | Description |
| Region | Select the region where the VPC resides. |
| Endpoint name | Enter a name that is easy to identify, such as privatelink-ai-registry. |
| Endpoint type | Select Interface endpoint. |
| Endpoint service | Select Alibaba Cloud Service, find the AI Registry endpoint service in the service list, and select it. The service name uses the format com.aliyuncs.{region-id}.ai-registry. For the China (Hangzhou) region, the service name is com.aliyuncs.cn-hangzhou.ai-registry. |
| VPC | Select the VPC that you want to connect. |
| Security Group | Select the security group to associate with the endpoint. The security group controls access permissions. |
| Zone and vSwitch | Select the zone and the corresponding vSwitch where the endpoint is deployed. We recommend that you select at least two zones for high availability (HA). |
In the advanced settings, for Enable Custom Domain Name?, select Enable and enter the following domain name:
airegistry.{region-id}.mse.aliyuncs.com
For the China (Hangzhou) region, enter airegistry.cn-hangzhou.mse.aliyuncs.com. Keep the other advanced settings at their default values.
Click OK to complete the creation. When the endpoint status changes to Available, the endpoint is ready for use.
Verify connectivity
After you complete Method 1 or Method 2, if an ECS instance already runs in the VPC, use the private network domain name on that instance to verify that the network is connected:
# Test network connectivity (China (Hangzhou) region as an example)
ping -c 4 airegistry.cn-hangzhou.mse.aliyuncs.comAfter you confirm connectivity, configure this domain name as the AI Registry access address of your application to access AI Registry over the private network.
Considerations
Region consistency: The VPC must be in the same region as the AI Registry instance. When you create an endpoint manually, the
{region-id}in the service name must also match the region.Multiple VPCs: The VPC Access section in Method 1 supports associating multiple VPCs. Repeat the steps for each VPC.
FAQ
Q: What do I do if I cannot find my VPC in the VPC Access section? A: Make sure that the account you log on with has VPC read permissions in the region of the VPC, and that the VPC is in the same region as the AI Registry instance.
Q: What do I do if I cannot access AI Registry after I associate the VPC? A: Check the following items in order:
The status of the VPC in the VPC Access section is Available.
The security group rules allow the required network traffic. The inbound and outbound rules of the security group must allow the required ports and protocols.
Your application uses the correct private network domain name
airegistry.{region-id}.mse.aliyuncs.com.The ECS instance runs in the associated VPC and zone.
Q: Can I use public network access and VPC private network access at the same time? A: Yes. The two access methods work independently and do not affect each other. A workspace can enable public network access and associate multiple VPCs at the same time.
Q: What do I do if I cannot find AI Registry in the endpoint service list? A: Make sure that the selected region supports PrivateLink access for AI Registry. If the region is correct but the service is still not listed, contact AI Registry technical support.
Q: What do I do if I cannot access AI Registry after I create the endpoint? A: Check the following items in order:
The endpoint status is Available.
The security group rules allow the required network traffic. The inbound and outbound rules of the security group must allow the required ports and protocols.
Your application uses the custom service domain name
airegistry.{region-id}.mse.aliyuncs.com.The ECS instance and the endpoint are in the same VPC.