PrivateLink lets you securely and reliably access services deployed in other VPCs from your Alibaba Cloud VPC or on-premises data center over private networks. It simplifies your network architecture and eliminates the security risks of accessing services over the public internet.
Overview
PrivateLink provides secure, flexible, and highly available private network connections for cross-account and cross-VPC services. PrivateLink users fall into two roles based on their use case:
As a service consumer, you don't need to configure IPv4 gateways, IPv6 gateways, NAT gateways, Elastic IP Addresses (EIPs), Transit Routers (TRs), or Express Connect Routers (ECRs) to communicate with services deployed in other VPCs from your Alibaba Cloud VPC or on-premises data center.
As a service provider, you can focus on service development. PrivateLink simplifies the network connection between you and service consumers, eliminating complex routing and security rule configurations.
PrivateLink supports the following connection scenarios:
Same-region connection: The endpoint and endpoint service are deployed in the same region.
Cross-region connection: The endpoint and endpoint service are deployed in different regions.
Use cases
Scenario 1: Access Alibaba Cloud services
In this scenario, Alibaba Cloud provides cloud services that support private access through PrivateLink.
Supports Alibaba Cloud services accessible through PrivateLink . For more information, see Alibaba Cloud services that integrate with PrivateLink .
To access Alibaba Cloud services from your VPC or on-premises data center, specify the Alibaba Cloud service name when you create an endpoint in your VPC. All requests sent to the endpoint are forwarded through PrivateLink to the corresponding Alibaba Cloud service. Additionally, clients in your on-premises data center can connect to your VPC through a networking product and access Alibaba Cloud services through the endpoint in the VPC.
When accessing Alibaba Cloud services through an interface endpoint, you can configure endpoint policies and security groups to control which client resources can access Alibaba Cloud services through the interface endpoint, meeting your security access requirements.
When accessing Alibaba Cloud services through a reverse endpoint, you can configure security groups to control the range of client resources that Alibaba Cloud services can access.
When accessing Alibaba Cloud services through a Gateway Load Balancer endpoint (GWLBe), you can customize VPC routing policies to control which client resources can access Alibaba Cloud services through the GWLBe.
Gateway endpoints do not rely on PrivateLink and support only a limited number of Alibaba Cloud services. When you create a gateway endpoint, you can configure endpoint policies to ensure secure access to Alibaba Cloud services.
Scenario 2: Share self-managed services
As a service provider, you can build services on Alibaba Cloud and share the managed services with service consumers.
You can create an endpoint service in your VPC and select a Network Load Balancer (NLB), Classic Load Balancer (CLB), or Application Load Balancer (ALB) as the service resource. By configuring a service allowlist, you can grant other Alibaba Cloud users access to the service. Other Alibaba Cloud users can create an interface endpoint in their own VPC by specifying the service name to connect to your endpoint service. All requests sent to the interface endpoint are forwarded through PrivateLink to your service.
Scenario 3: Access network virtual appliances
As a service provider, you can deploy network virtual appliances, such as firewalls, intrusion detection systems, traffic mirroring tools, and deep packet inspection tools, on Alibaba Cloud Gateway Load Balancer (GWLB) and share these managed network virtual appliances with other Alibaba Cloud users.
You can create an endpoint service in your VPC and select GWLB as the service resource. By configuring a service allowlist, you can grant other Alibaba Cloud users access to your network virtual appliances. Other Alibaba Cloud users can create a GWLBe in their own VPC by specifying the service name to connect to your endpoint service. All traffic sent to the GWLBe is forwarded through PrivateLink to your network virtual appliances.
As a service consumer, you can configure the GWLBe as the next hop for VPC routing. Through VPC routing policies, you can precisely control which client traffic is routed to the GWLBe to access network virtual appliances. After traffic reaches the GWLBe, PrivateLink forwards it to the GWLB in the same zone. The GWLB encapsulates the original packets using Geneve tunneling and forwards the traffic to healthy backend network virtual appliances based on traffic scheduling algorithms.
Benefits
Secure network transmission
Traffic is transmitted over private networks when you access services through PrivateLink. This approach is more secure than accessing services over the public internet. PrivateLink provides comprehensive security features for fine-grained access control.
Simplified network management
The networks of service providers and service consumers are independent of each other and allow address conflicts. PrivateLink provides secure cross-account and cross-VPC service access, eliminating the need for complex routing and security rule configurations.
PrivateLink allows service consumers to use private IP addresses in their VPC to access services. This seamlessly integrates with your existing network architecture to meet your cross-VPC and on-premises data center service access needs.
High availability and auto-scaling
Access requests are forwarded between clients and servers in the same zone, ensuring minimal latency. Combined with Alibaba Cloud DNS, interface endpoints provide multi-zone failover.
PrivateLink supports automatic scaling based on service traffic changes. It provides different scaling limits based on the service resource type to meet diverse scaling requirements.
Cross-region connection support
PrivateLink supports cross-region connections. Endpoints and endpoint services can be deployed in different regions to meet the private network service access needs of globally distributed architectures, without the need to deploy services in each region.
Access PrivateLink
Register an Alibaba Cloud account to access and manage PrivateLink through the following methods:
PrivateLink console: an interactive web interface for managing private network access services.
Alibaba Cloud SDK: provides SDKs in multiple programming languages, including Java, Go, PHP, Python, C#, and C++.
OpenAPI portal: provides features such as quick API search, online API calls, and dynamic SDK sample code generation.
Terraform: an open-source tool that lets you manage Alibaba Cloud resources and resources from other Terraform-supported cloud providers through configuration files with version control.