PrivateLink:Access Alibaba Cloud services

1. Go to the Endpoint - Create Endpoint page.

2. Configure the interface endpoint:

   • Basic Settings:

     • Region: Select the region where the target Alibaba Cloud service is deployed.

     • Name and Description: Identify the endpoint with a name and description.

   • Type: Select Alibaba Cloud Service.

   • Available Services: Select the Alibaba Cloud service you want to access by its endpoint service name.

     Available: The service is deployed in the selected region, and you have permission to connect.

   • Network Settings:

     • For high availability, select vSwitches in at least two zones. You can specify an IP address from the vSwitch for the endpoint zone's ENI, or let the system assign one automatically.

       You cannot specify a system reserved IP address of a vSwitch for an ENI.

     • IP Version: If the service supports dual-stack, select Dual-stack to allow both IPv4 and IPv6 access. Otherwise, select IPv4.

   • Security Group: Associate a security group to control inbound traffic to ENIs in all endpoint zones.

   • Advanced Settings:

     • Enable Custom Domain Name?: If the service supports a custom service domain name, enable this option. Use a custom domain name to access an Alibaba Cloud service.

     • Enable Zone Affinity: If the Alibaba Cloud service supports zone affinity, you can enable or disable this feature.

       • When this feature is enabled, if a service consumer in the same zone as the interface endpoint accesses the service by using the endpoint domain name, Alibaba Cloud DNS prioritizes returning the IP address of the ENI in the corresponding endpoint zone. This provides nearest access.

       • If you access the service from a zone where no interface endpoint is deployed, or if you disable zone affinity, Alibaba Cloud DNS returns the IP addresses of available ENIs in all endpoint zones.

     • Endpoint policy: Keep the Default endpoint policy for full access. Custom policy availability depends on the target service (Custom endpoint policy).

3. After creation, test the connection from an ECS instance in the same VPC:

   ping <IP address of the ENI in the endpoint zone>
   # You can view the IP address of the ENI on the Zone and Network Interface Card tab of the instance details page.
   # For HTTP/HTTPS services, we recommend that you directly access the service port.
   curl -sI http://<endpoint domain name>
   # You can view the endpoint domain name on the endpoint list page.
   # The inbound rules of the security group must allow access over HTTP (port 80) and HTTPS (port 443).
   # Whether you can use HTTPS to access the service depends on the service.

Configure multiple zones

• When you create an interface endpoint, select vSwitches in at least two zones.

• After the endpoint is created, click the ID of the target interface endpoint. On the Zone and ENI tab, click Add Zone.

  Click Delete in the Actions column of the target zone to remove the zone from the service.

You can then view the Zone Domain and IP Address of the ENI on the Zone and ENI tab.

For high availability, use the endpoint domain name to access the service. View the Endpoint Domain on the interface endpoint list page.

Enable or disable zone affinity

• When you create an interface endpoint, configure Enable Zone Affinity.

• After the endpoint is created, click the ID of the target interface endpoint. On the Basic Information tab, toggle the switch next to Enable Zone Affinity to Enable or Disable.

Configure security groups

When you configure an interface endpoint, you must assign it to one or more security groups. After the endpoint is created, you can add or remove security groups.

• Add a security group: On the Security Group tab of the target endpoint's details page, click Join Security Group.

• Remove a security group: Click Delete in the Actions column of the security group that you want to remove.

Only traffic matching the associated security group rules can reach the service. Example configurations:

• Inbound: Adding rules that allow only specific IP addresses blocks all other clients from accessing the service through this endpoint.

• Outbound: All access is allowed by default, permitting ECS instances to reach external resources.

Configure a network ACL

1. Go to the VPC console - Network ACL page. Select the target region at the top of the page and click Create Network ACL.

2. For VPC, select the VPC where the interface endpoint is located.

3. Click the instance ID or click Manage in the Actions column. On the Associated Resources tab, click Associate vSwitch, select the target vSwitch to which the interface endpoint belongs, and then click OK. The associated vSwitch controls traffic that enters and leaves the vSwitch based on the network ACL rules.

   To remove the control, you can click Unbind in the Actions column of the target vSwitch on this tab after it is associated.

4. On the Inbound Rules/Outbound Rules tab of the target network ACL, click Manage Inbound Rule/Manage Outbound Rule. If traffic matches a network ACL rule based on the Protocol, IP Version, Source IP Address/Destination IP Address, and Source Port Range, the system applies the specified Policy to allow or deny the traffic.

Configure an endpoint policy

You can configure an endpoint policy when accessing an Alibaba Cloud service. After creation, modify the policy on the Endpoint Policy tab by clicking Edit.

1. Go to the Endpoint - Create Endpoint page.

2. Configure the interface endpoint:

   • Region: Select the region where the target Alibaba Cloud service is deployed.

   • Type: Select Alibaba Cloud Service.

   • Service Settings: Select Enable inter-region endpoint and select a Service Region.

   • Available Services: From the list of Alibaba Cloud services supported in the service region, select the destination service by its endpoint service name.

   • Inter-Region Bandwidth Configuration:

     • Billing Method: Billed by CDT. Cross-region traffic fees are uniformly settled and billed by CDT. For a complete list of billable items, see Cross-region private connections.

     • Bandwidth: If the Connected Regions is for connections between regions in the Chinese mainland, the default cross-region bandwidth is 1,000 Mbit/s. If it is for connections between regions outside the Chinese mainland, the default cross-region bandwidth is 100 Mbit/s. You can adjust these values by using the pvl_quota_cross_region_ep_max_bandwidth_payg_china and pvl_quota_cross_region_ep_max_bandwidth_payg_oversea quotas.

   • For other configurations, see Create or delete an interface endpoint.