## Set up a private network link to Amazon MSK

URL: https://docs.atlan.com/apps/connectors/messaging/amazon-msk/how-tos/set-up-a-private-network-link-to-amazon-msk

> :::warning Who can do this? You will need your Amazon MSK or AWS administrator involved - you may not have access to run these tasks.

:::warning Who can do this?
 You will need your Amazon MSK or AWS administrator involved - you may not have access to run these tasks.

:::

[AWS PrivateLink](https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-privatelink.html) creates a secure, private connection between services running in AWS, ensuring that traffic between services remains within the AWS network. This document describes the steps to set this up between Amazon MSK and Atlan.

## Prerequisites

Before you can set up private network connectivity, ensure the following:

- Amazon MSK version: Apache Kafka 2.7.1 or higher.
- Authentication type: only IAM role-based authentication is supported.
- Cluster instance type: must be larger than t3.small.
- Region alignment: both your Amazon MSK cluster and Atlan tenant must reside in the same AWS region.

For more information, refer to [Requirements and Limitations for Multi-VPC Private Connectivity](https://docs.aws.amazon.com/msk/latest/developerguide/aws-access-mult-vpc.html#mvpc-requirements).

## Request Atlan's details

To configure private network connectivity between your AWS account and Atlan, [contact Atlan support](https://docs.atlan.com/support/submit-request) for the following details:

- Atlan's AWS account ID

## Enable private network link

To verify or enable AWS PrivateLink for Amazon MSK:

1. Sign in to the AWS Management Console and open the [Amazon MSK Console](https://console.aws.amazon.com/msk/).
2. From the left menu, click **Clusters**.
3. On the _Clusters_ page, under _Cluster name_, select the cluster for which you want to enable private network link.
4. On your cluster page, below the overview section, click the **Properties** tab.
5. In the _Properties_ tab, navigate to the _Networking settings_ section to verify or enable AWS PrivateLink connectivity: 
 - If you have verified that AWS PrivateLink is turned on, skip to the next section.
 - If AWS PrivateLink is turned off, click the **Edit** button and then click **Turn on multi-VPC connectivity** to enable it.
 1. In the _Turn on multi-VPC connectivity_ page, for _Authentication type_, click **IAM role-based authentication**.
 2. At the bottom of the screen, click **Turn on selection**. The cluster will undergo a rolling update, which may take several minutes to a few hours to complete.

## Grant access to Atlan

Once AWS PrivateLink is enabled for your Amazon MSK cluster, you will need to update the cluster policy to grant access to Atlan.

To update your Amazon MSK cluster policy:

1. Sign in to the AWS Management Console and open the [Amazon MSK Console](https://console.aws.amazon.com/msk/).
2. From the left menu, click **Clusters**.
3. On the _Clusters_ page, under _Cluster name_, select the cluster for which you enabled private network link.
4. On your cluster page, below the overview section, click the **Properties** tab.
5. In the _Properties_ tab, navigate to the _Security settings_ section and then click **Edit cluster policy**.
6. In the _Edit cluster policy_ page, under _Cluster policy_, configure the following:
 1. Click **Basic** as the new cluster policy.
 2. For _Account ID(s) that need cluster access_, enter Atlan's AWS account ID.
 3. Click the **Include Kafka service principal** checkbox to allow Atlan access to Kafka services only.
 4. Click **Save changes** to save your selections.

## Notify Atlan support team

Once you've completed the steps above, [contact the Atlan support team again](https://docs.atlan.com/support/submit-request) and provide the following details for your Amazon MSK cluster:

- Amazon MSK Cluster ARN - the unique identifier of your cluster

Atlan will create a [managed VPC connection to your Amazon MSK cluster](https://docs.aws.amazon.com/msk/latest/developerguide/aws-access-mult-vpc.html). Once completed, Atlan support will send you the cluster connection string (bootstrap servers) required for accessing Amazon MSK via AWS PrivateLink.

You can now enter the cluster connection string for the _Bootstrap servers_ field to [crawl Amazon MSK](https://docs.atlan.com/llms/connectors/amazon-msk/crawl-amazon-msk/llms.txt). Atlan will securely connect to your Amazon MSK cluster using AWS PrivateLink.

---