Skip to main content
Community Hub

Set up AWS PrivateLink (self-serve)

TL;DR

Connect Atlan to your database on Amazon RDS, Aurora, or EC2 over AWS PrivateLink, set up yourself in Admin > Networking.

Your AI can read this via Docs MCPcurl -fsSL "https://docs.atlan.com/install-docs-mcp" | bashConnect

Connect Atlan to your database on Amazon RDS, Aurora, or EC2 over AWS PrivateLink. You set up the private link once, in Admin > Networking. After that, the connector workflows for the database reach it through the link.

How it works​

What's involved​

Atlan connects to your endpoint service after you add Atlan's principal to its allowed principals and accept Atlan's connection request.

Who's involved and why​

The resources on your side live in your AWS account, so someone with access to that account has to create them. Atlan splits the setup accordingly: Atlan generates the AWS commands with its own values filled in, someone on your side runs them, and Atlan checks the output before it creates its side of the link.

  • Atlan admin. Runs the setup in Admin > Networking. Only admins see Networking.
  • Your AWS team. Anyone with the AWS permissions the commands need. Runs Atlan's commands in the AWS account where the database runs, sends back the output, and accepts Atlan's connection request.
  • Atlan. Generates the commands, checks the output, creates its side of the link, and reports the status.

Copy instructions puts the commands and what to send back into one message for your AWS team.

Have access to both?

If you're an Atlan admin with the AWS permissions Atlan lists, run the commands yourself, for example in AWS CloudShell, and paste the output into Atlan. To skip the commands, choose Enter zone IDs yourself and Enter the details yourself. Atlan can't verify typed values.

Before you begin​

Prerequisites​

  • You're an Atlan admin.
  • Your Atlan tenant runs on AWS. This setup isn't available on Azure or Google Cloud tenants yet. For private connectivity there, see Azure Private Link or Google Cloud Private Service Connect.
  • The database is in the same AWS region as your Atlan tenant. Atlan shows its region at the start of the setup.
  • The database accepts TCP connections on a single port. See Limitations for the ports Atlan supports.
  • Your AWS team can create an NLB, a target group, and a VPC endpoint service in the VPC your database runs in, and change the database's security group. Atlan lists the AWS permissions its commands need. If you already have an endpoint service in front of the database, your AWS team only needs to change its allowed principals.

Choose endpoint service​

Decide with your AWS team whether Atlan's commands create a new endpoint service or use one you already have:

  • Build a new one: Atlan's commands create the NLB, target group, and VPC endpoint service in the database's VPC, and open the database port to that VPC in the database's security group. The database can't be publicly accessible, because the commands find it by its private IP address.
  • Use one you already have: if an endpoint service already sits in front of the database. If its NLB has a security group, turn off Enforce inbound rules on PrivateLink traffic on it.

Atlan walks you through the setup in Admin > Networking. Each step shows the commands, values, and checks for your tenant. Atlan saves your progress as a draft, so you can stop and come back.

  1. In Admin > Networking, select Create private link, then Database on AWS.
  2. Follow the steps in Atlan. When a step needs your AWS team, select Copy instructions, send them the message, and paste the output they send back.
  3. Select Request private link.
  4. When the link shows Waiting for you to accept, send your AWS team the accept command that Atlan shows. Requests that wait too long expire, and the link fails.
  5. Wait for the link to show Ready. Atlan updates the status while the link is set up. If you chose your database's hostname, the link shows Setting up DNS before Ready. To refresh the status right away, select Check status.

When the link is Ready, set up the connector workflow for the database as usual. You don't choose the private link in the workflow. The workflow uses the link because it connects to the link's hostname. Take these values from the private link:

Connector fieldValue
HostThe hostname Atlan shows on the link: your database's hostname, or the endpoint's vpce-… hostname. Open the link on the Networking page to copy it.
PortThe port you entered in Port your database listens on.

Enter the database credentials and other settings in the workflow as usual.

What happens during workflow runs​

If you chose the endpoint's hostname, the lookup uses AWS's public DNS for the vpce-… name instead of Atlan's private DNS. If you chose your database's hostname, certificate checks keep working, because the workflow connects to the name on the database's certificate.

Limitations​

  • One database per private link. Each link has one endpoint service and one port. Create a separate private link for each database. An endpoint service can have only one private link.
  • One setup at a time. Your workspace can have one private link in setup at a time. Start the next one when the current one finishes.
  • Same region only. For a database in another region, see Cross-region private network connectivity.
  • Ports. The port must be 443 or 1024 to 65535. A few reserved ports aren't supported. For other ports, contact Atlan support.
  • Hostnames. The hostname must be a full name with at least three parts, such as orders.db.example.com. IP addresses, wildcards, Atlan names, and internal names (.internal, cluster.local, localhost) aren't allowed. AWS names are allowed only as one database's full Amazon RDS, Aurora, RDS Proxy, or provisioned Amazon Redshift endpoint. Redshift Serverless endpoints aren't supported.
  • Changes after you request a link. You can't edit or delete a link after you request it. To change or remove a link that's requested, ready, or failed, contact Atlan support.
  • Other sources and clouds. On-premises sources, vendor-hosted services such as Snowflake and Databricks, and Azure and Google Cloud aren't available in this setup yet. To find the pattern that fits your source, see Private network connectivity to your data sources.

Troubleshooting​

The link stays in Waiting for you to accept. Run the command in Accept Atlan's connection request on your endpoint service. It accepts the pending request from Atlan's AWS account. The status updates on its own, or select Check status to refresh it. Requests that wait too long expire, and the link fails.

The link shows Failed. Atlan shows the reason. Fix the cause and start a new private link. If Atlan doesn't report a reason, select Contact Atlan support.

The link fails because the hostname is already in use. Your Atlan tenant already has DNS for that name. Atlan doesn't check this before you request the link, so the link shows Failed after the request. Start a new private link with a different hostname.

Atlan shows Private links aren't switched on for this workspace yet. Self-serve private links are available on every AWS-hosted tenant. Contact Atlan support. If your tenant runs on Azure or Google Cloud, this setup isn't available.

Atlan shows Private link is available for AWS tenants only. Your tenant runs on Azure or Google Cloud, where this setup isn't available yet. For private connectivity there, see Azure Private Link or Google Cloud Private Service Connect.

The link is Ready but the connector can't connect. Check that the NLB target group is healthy, that the database security group permits traffic from the NLB, and that the connector uses the hostname and port Atlan shows. For more checks, see Private connectivity over AWS PrivateLink.

See also​