## Set up a private network link to Trino

URL: https://docs.atlan.com/apps/connectors/database/trino/how-tos/set-up-a-private-network-link-to-trino

> :::warning Who can do this? You will need your AWS administrator involved - you may not have access to run these tasks yourself.

:::warning Who can do this?
 You will need your AWS administrator involved - you may not have access to run these tasks yourself.

:::

[AWS PrivateLink](https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-privatelink.html) creates a secure, private connection between services running in AWS. This document describes the steps to set this up between Trino and Atlan.

## Prerequisites

You should already have the following:

- Trino instance running in AWS (private EC2 instance).
- Atlan hosted in the same region as the Trino instance.

:::info **Did you know?** 
 You will also need Atlan's AWS account ID later in this process. If you do not already have this, [request it now from support](https://docs.atlan.com/support/submit-request).

:::

## Set up network to EC2 instance

To set up the private network of your Trino EC2 instance, from within [AWS](https://console.aws.amazon.com/):

### Copy network settings

To copy the network settings of your EC2 instance:

1. Navigate to **Services**, then **Compute**, then **EC2**.
2. On the left, under _Instances_, click **Instances**.
3. In the _Instances_ table, click your Trino EC2 instance.
4. Under the instance's _Details_ tab:
 1. Under _VPC ID_, copy the VPC identifier.
 2. Under _Subnet ID_, click the subnet for the instance.
 3. In the _Subnets_ table, copy the value under the _IPv4 CIDR_ column.

### Create inbound rule

To create an inbound rule allowing your private subnet access to your EC2 instance:

1. Navigate to **Services**, then **Compute**, then **EC2**.
2. On the left, under _Instances_, click **Instances**.
3. In the _Instances_ table, click your Trino EC2 instance.
4. Under the instance's details, change to the **Security** tab.
5. Under _Security groups_, click the security group for the instance.
6. Under the _Inbound rules_ tab, click the **Edit inbound rules** button.
7. At the bottom left of the _Inbound rules_ table, click the **Add rule** button.
 1. For _Type_, select **Custom TCP**.
 2. For _Port range_, enter the port on which Trino is accessible (for example, **80**).
 3. For _Source_, choose **Custom** and enter the CIDR range for your Trino instance (see [Copy network settings](https://docs.atlan.com/llms/connectors/trino/set-up-a-private-network-link-to-trino/llms.txt)).
8. Below the bottom right of the _Inbound rules_ table, click the **Save rules** button.

## Create internal Network Load Balancer

### Start creating NLB

To create an NLB, from within AWS:

1. Navigate to **Services**, then **Compute**, then **EC2**.
2. On the left, under _Load Balancing_, click on **Load Balancers**.
3. At the top of the screen, click the **Create Load Balancer** button.
4. Under the _Network Load Balancer_ option, click the **Create** button.
5. Enter the following _Basic configuration_ settings for the load balancer:
 1. For _Load balancer name_, enter a unique name.
 2. For _Scheme_, select **Internal**.
 3. For _IP address type_, select **IPv4**.
6. Enter the following _Network mapping_ settings for the load balancer:
 1. For _VPC_, select the VPC where the Trino instance is located (see [Copy network settings](https://docs.atlan.com/llms/connectors/trino/set-up-a-private-network-link-to-trino/llms.txt)).
 2. For _Mappings_, select the availability zones with private subnets.
7. Enter the following _Listeners and routing_ settings for the load balancer:
 1. For _Port_, enter **80** (or the non-default port value used in [Created inbound rule](https://docs.atlan.com/llms/connectors/trino/set-up-a-private-network-link-to-trino/llms.txt)).
 2. For _Default action_, click the **Create target group** link. This will open the target group creation in a new browser tab.

### Create target group

To create a target group for the NLB:

1. Enter the following _Basic configuration_ settings for the target group:
 1. For _Choose target type_, select **Instances**.
 2. For _Target group name_, enter a name.
 3. For _Port_, enter **80** (or the non-default port value used in [Create inbound rule](https://docs.atlan.com/llms/connectors/trino/set-up-a-private-network-link-to-trino/llms.txt)).
 4. For _VPC_, select the VPC where the Trino instance is located (see [Copy network settings](https://docs.atlan.com/llms/connectors/trino/set-up-a-private-network-link-to-trino/llms.txt)).
 5. At the bottom of the form, click the **Next** button.
2. From the _Available instances_ table:
 1. Click the checkbox next to your Trino instance.
 2. Enter the port for the instance (80 or non-default value used in steps above).
 3. Click the **Include as pending below** button.
3. At the bottom right of the form, click the **Create target group** button.

### Finish creating NLB

Return to the browser tab where you started the NLB creation, and continue:

1. Under _Listeners and routing_, click the refresh arrow to the far right of the _Default action_ drop-down box.
2. Select the target group you created above in the _Default action_ drop-down.
3. At the bottom right of the form click the **Create load balancer** button.
4. In the resulting screen, click the **View load balancer** button.

### Verify target group is healthy

To verify the target group is healthy:

1. From the EC2 menu on the left, under _Load Balancing_ click **Target Groups**.
2. From the _Target groups_ table, click the row for the target group you created above.
3. At the bottom of the screen, under the _Details_ tab, check that there is a 1 under both _Total targets_ and _Healthy_.

## Create endpoint service

To create an endpoint service, from within [AWS](https://console.aws.amazon.com/):

1. Navigate to **Services**, then **Networking & Content Delivery**, then **VPC**.
2. From the menu on the left, under _Virtual private cloud_ click **Endpoint services**.
3. At the top of the page, click the **Create endpoint service** button.
4. Enter the following _Endpoint service settings_:
 1. For _Name_ enter a meaningful name.
 2. For _Load balancer type_ choose **Network**.
5. For _Available load balancers_ select the load balancer you created above in [Create internal Network Load Balancer](https://docs.atlan.com/llms/connectors/trino/set-up-a-private-network-link-to-trino/llms.txt).
6. Enter the following _Additional settings_:
 1. For _Require acceptance for endpoint_ enable **Acceptance required**.
 2. For _Supported IP address types_ enable **IPv4**.
7. At the bottom right of the form, click the **Create** button.
8. Under the _Details_ of the endpoint service, copy the hostname under _Service name_.

## Allow Atlan account access

To allow Atlan's account access to the service, from within the endpoint service screen:

1. At the bottom of the screen, change to the **Allow principals** tab.
2. At the top of the _Allow principals_ table, click the **Allow principals** button.
3. Under _Principals to add_ and _ARN_ enter the Atlan account ID.
4. At the bottom right of the form, click the **Allow principals** button.

## Notify Atlan support

Once all the above steps are complete, [provide Atlan support](https://docs.atlan.com/support/submit-request) with the following information:

- The hostname for the endpoint service created above.
- The port number for the Trino instance.

There are additional steps Atlan then needs to complete:

- Creating a security group.
- Creating an endpoint.

Once the Atlan team has confirmed the configuration is ready, please continue with the remaining steps.

## Accept the consumer connection request

To accept the consumer connection request, from within AWS:

1. Navigate to **Services**, then **Networking & Content Delivery**, then **VPC**.
2. From the menu on the left, under _Virtual private cloud_, click **Endpoint services**.
3. From the _Endpoint services_ table, select the endpoint service you created in [Create endpoint service](https://docs.atlan.com/llms/connectors/trino/set-up-a-private-network-link-to-trino/llms.txt).
4. At the bottom of the screen, change to the **Endpoint connections** tab.
 1. You should see a row in the _Endpoint connections_ table with a _State_ of _Pending_.
 2. Select this row, and click the **Actions** button and then **Accept endpoint connection request**.
 3. If prompted to confirm, type **accept** into the field and click the **Accept** button.
5. Wait for this to complete, it could take about 30 seconds.

😅 The connection is now established. You can now use the service endpoint provided by Atlan support as the hostname to [crawl Trino](https://docs.atlan.com/llms/connectors/trino/crawl-trino/llms.txt) in Atlan! 🎉

---