## Set up a private network link to Hive

URL: https://docs.atlan.com/apps/connectors/database/hive/how-tos/set-up-a-private-network-link-to-hive

> Once the Atlan team has confirmed the configuration is ready, please continue with the remaining steps.

[AWS PrivateLink](https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-privatelink.html) creates a secure, private connection between services running in AWS. This document describes the steps to set this up between Hive and Atlan.

:::warning Who can do this?
 You need your AWS administrator involved—you may not have access to run these tasks yourself.

:::

## Prerequisites

Verify you have the following:

- Hive instance running in AWS (private EMR instance).
- Atlan hosted in the same region as the Hive instance.

:::info **Did you know?** 
 You also need Atlan's AWS account ID later in this process. If you don't already have this, [request it now from support](https://docs.atlan.com/support/submit-request).

:::

## Set up network to EMR instance

To set up the private network of your Hive EMR instance, from within [AWS](https://console.aws.amazon.com/):

### Copy network settings

To copy the network settings of your Hive EMR instance:

1. From the left menu, under _EMR on EC2_, click **Clusters**.
2. In the _Clusters_ table, click on your Hive EMR cluster.
3. From the cluster's _Network and security_ tab, under _Network_, for _Virtual Private Cloud (VPC)_, click on your VPC to view more details.
4. Under your VPC's _Details_ tab, copy and save the value under the _IPv4 CIDR_ column.

### Create inbound rule

To create an inbound rule allowing your VPC access to your Hive EMR instance:

1. From the left menu, under _EMR on EC2_, click **Clusters**.
2. In the _Clusters_ table, click on your Hive EMR cluster.
3. From the cluster's _Network and security_ tab, click the downward arrow for **EC2 security groups (firewall)** to expand this section.
4. Under _EC2 security groups (firewall)_, click on a security group for the cluster.
5. Under the _Inbound rules_ tab, click the **Edit inbound rules** button.
6. At the bottom left of the _Inbound rules_ table, click the **Add rule** button.
 1. For _Type_, select **All traffic**.
 2. For _Port_, enter the port on which Hive is accessible.
 3. For _Source_, choose **Custom** and enter the CIDR range for your Hive instance (see [Copy network settings](https://docs.atlan.com/llms/connectors/hive/set-up-a-private-network-link-to-hive/llms.txt)).
7. Below the bottom right of the _Inbound rules_ table, click the **Save rules** button. Repeat steps 4 to 7 for each security group in the cluster.

<!-- vale Microsoft.Headings = NO -->

## Create internal Network Load Balancer

<!-- vale Microsoft.Headings = YES -->

<!-- vale Microsoft.Headings = NO -->

### Start creating NLB

<!-- vale Microsoft.Headings = YES -->

To create an NLB, from within AWS:

1. Navigate to **Services**, then **Compute**, then **EC2**.
2. On the left, under _Load Balancing_, click on **Load Balancers**.
3. At the top of the screen, click the **Create Load Balancer** button.
4. Under the _Network Load Balancer_ option, click the **Create** button.
5. Enter the following _Basic configuration_ settings for the load balancer:
 1. For _Load balancer name,_ enter a unique name.
 2. For _Scheme_, select **Internal**.
 3. For _IP address type_, select **IPv4**.
6. Enter the following _Network mapping_ settings for the load balancer:
 1. For _VPC_, select the VPC where the Hive instance is located (see [Copy network settings](https://docs.atlan.com/llms/connectors/hive/set-up-a-private-network-link-to-hive/llms.txt)).
 2. For _Mappings_, select the availability zones with private subnets.
7. Enter the following _Listeners and routing_ settings for the load balancer:
 1. For _Port_, enter the port value used in [Created inbound rule](https://docs.atlan.com/llms/connectors/hive/set-up-a-private-network-link-to-hive/llms.txt).
 2. For _Default action_, click the **Create target group** link. This opens the target group creation in a new browser tab.

### Create target group

To create a target group for the NLB:

1. Enter the following _Basic configuration_ settings for the target group:
 1. For _Choose target type_, select **Instances**.
 2. For _Target group name_, enter a name.
 3. For _Port_, enter the port value used in [Create inbound rule](https://docs.atlan.com/llms/connectors/hive/set-up-a-private-network-link-to-hive/llms.txt).
 4. For _VPC_, select the VPC where the Hive instance is located (see [Copy network settings](https://docs.atlan.com/llms/connectors/hive/set-up-a-private-network-link-to-hive/llms.txt)).
 5. At the bottom of the form, click the **Next** button.
2. From the _Available instances_ table:
 1. Click the checkbox next to your Hive instance.
 2. Enter the port value used in [Create inbound rule](https://docs.atlan.com/llms/connectors/hive/set-up-a-private-network-link-to-hive/llms.txt).
 3. Click the **Include as pending below** button.
3. At the bottom right of the form, click the **Create target group** button.

<!-- vale Microsoft.Headings = NO -->

### Finish creating NLB

<!-- vale Microsoft.Headings = YES -->

Return to the browser tab where you started the NLB creation, and continue:

1. Under _Listeners and routing_, click the refresh arrow to the far right of the _Default action_ drop-down box.
2. Select the target group you created in the _Default action_ drop-down.
3. At the bottom right of the form click the **Create load balancer** button.
4. In the resulting screen, click the **View load balancer** button.

### Verify target group is healthy

To verify the target group is healthy:

1. From the EC2 menu on the left, under _Load Balancing_ click **Target Groups**.
2. From the _Target groups_ table, click the row for the target group you created.
3. At the bottom of the screen, under the _Details_ tab, check that there is a 1 under both _Total targets_ and _Healthy_.

## Create endpoint service

To create an endpoint service, from within [AWS](https://console.aws.amazon.com/):

1. Navigate to **Services**, then **Networking & Content Delivery**, then **VPC**.
2. From the menu on the left, under _Virtual private cloud_ click **Endpoint services**.
3. At the top of the page, click the **Create endpoint service** button.
4. Enter the following _Endpoint service settings_:
 1. For _Name_, enter a meaningful name.
 2. For _Load balancer type_, choose **Network**.
5. For _Available load balancers_, select the load balancer you created in [Create internal Network Load Balancer](https://docs.atlan.com/llms/connectors/hive/set-up-a-private-network-link-to-hive/llms.txt).
6. Enter the following _Additional settings_:
 1. For _Require acceptance for endpoint_, enable **Acceptance required**.
 2. For _Supported IP address types_, enable **IPv4**.
7. At the bottom right of the form, click the **Create** button.
8. Under the _Details_ of the endpoint service, copy the hostname under _Service name_.

## Allow Atlan account access

To grant Atlan's account access to the service, from within the endpoint service screen:

1. At the bottom of the screen, change to the **Allow principals** tab.
2. At the top of the _Allow principals_ table, click the **Allow principals** button.
3. Under _Principals to add_ and _ARN_, enter the Atlan account ID.
4. At the bottom right of the form, click the **Allow principals** button.

## Notify Atlan support

Once all the previous steps are complete, [provide Atlan support](https://docs.atlan.com/support/submit-request) with the following information:

- The hostname for the endpoint service you created.
- The port number for your Hive instance.

There are additional steps Atlan then needs to complete:

- Creating a security group.
- Creating an endpoint.

Once the Atlan team has confirmed the configuration is ready, please continue with the remaining steps.

## Accept consumer connection request

To accept the consumer connection request, from within AWS:

1. Navigate to **Services**, then **Networking & Content Delivery**, then **VPC**.
2. From the menu on the left, under _Virtual private cloud_ click **Endpoint services**.
3. From the _Endpoint services_ table, select the endpoint service you created in [Create endpoint service](https://docs.atlan.com/llms/connectors/hive/set-up-a-private-network-link-to-hive/llms.txt).
4. At the bottom of the screen, change to the **Endpoint connections** tab.
 1. Verify a row in the _Endpoint connections_ table has a _State_ of _Pending_.
 2. Select this row, and click the **Actions** button and then **Accept endpoint connection request**.
 3. If prompted to confirm, type **accept** into the field and click the **Accept** button.
5. Wait for this to complete. It typically takes about 30 seconds.

😅 The connection is now established. You can now use the service endpoint provided by Atlan support as the hostname to [crawl Hive](https://docs.atlan.com/llms/connectors/hive/crawl-hive/llms.txt) in Atlan! 🎉

---