Simple Log Service:Access Simple Log Service via PrivateLink

Why use PrivateLink

Accessing cloud services over the public internet poses several challenges:

• Data security: Public internet access can expose sensitive information.

• Address conflicts: Default cloud service CIDR blocks may overlap with your data center's.

• Traffic governance: Traditional private access makes it hard to independently audit cloud service traffic.

PrivateLink addresses these challenges:

• Data privacy: Traffic stays off the public internet, reducing data leak risks.

• Simplified architecture: Eliminates routing complexity and address conflicts between cloud and on-premises environments.

• Granular access control: Source authentication enables precise permission management. VPC flow logs and traffic mirroring provide comprehensive traffic auditing.

Prerequisites

• PrivateLink is currently an allowlisted feature. To use this feature, you must submit a ticket.

• A VPC and a vSwitch must exist in the region where you plan to create the endpoint. Create and manage a VPC.

• An ECS instance must exist in the same VPC. Purchase and use an ECS instance in the console.

Billing

• Activating PrivateLink is free. After activation, hourly billing applies for instance and traffic processing. Billing of PrivateLink.

• The service consumer and provider can be different Alibaba Cloud accounts, and fees can be billed to either account. Payer.

Procedure

1. Create an endpoint.

   1. Log on to the VPC console.

   2. In the left-side navigation pane, click Endpoints.

   3. In the top navigation bar, select the region of the SLS resources to access.

   4. On the Endpoints page, click the interface endpoint tab, and then click Create Endpoint.

   5. On the Create Endpoint page, configure the following parameters. Use default values for other parameters.

      Parameter	Description
      Node Name	Enter a custom name for the endpoint.
      Endpoint Type	Select interface endpoint to access the service through an interface endpoint.
      Endpoint Service	Click Alibaba Cloud Service. In the search box, enter com.aliyuncs.privatelink.${region_id}.log and select the endpoint service. Note Replace ${region_id} with your SLS project's region ID, for example, cn-hangzhou for China (Hangzhou). Supported regions. An endpoint can be associated with only one endpoint service.
      VPC	Select the VPC in which you want to create the endpoint.
      Security Group	Select a security group for the endpoint elastic network interface (ENI) to control its traffic.
      Zone and vSwitch	Select an available zone where the endpoint service is supported, and then select a vSwitch in that zone. An endpoint ENI is automatically created in each selected vSwitch.

   6. Click Create.

      After creation, note the endpoint domain name for accessing SLS.

      The Endpoint Service Domain Name section at the bottom of the details page lists the default service domain name (format: ep-{instance-id}.log.cn-hangzhou.privatelink.aliyuncs.com) and the custom service domain name (*.cn-hangzhou-internal.log.aliyuncs.com, available after enablement).

2. Use the endpoint domain name to access SLS.

   1. Connect to the ECS instance. Connect to an ECS instance.

   2. Use an SDK to access SLS through the endpoint domain name.

      import com.aliyun.openservices.log.Client;
      import com.aliyun.openservices.log.exception.LogException;
      public class CreateProject {
          public static void main(String[] args) throws LogException {
              // This example shows how to obtain an AccessKey ID and an AccessKey secret from environment variables.
              String accessId = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID");
              String accessKey = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET");
              // Enter the project name.
              String projectName = "ali-test-project";
              // Enter the endpoint domain name.
              String host = "https://cn-hangzhou-internal.log.aliyuncs.com";
              // Create a Simple Log Service client.
              Client client = new Client(host, accessId, accessKey);
              // Create a project.
              try {
                  String projectDescription = "project description";
                  System.out.println("ready to create project");
                  client.CreateProject(projectName, projectDescription);
                  System.out.println(String.format("create project %s success",projectName));
              } catch (LogException e) {
                  System.out.println("LogException e :" + e.toString());
                  System.out.println("error code :" + e.GetErrorCode());
                  System.out.println("error message :" + e.GetErrorMessage());
              }
          }
      }