Skip to content
Search ⌘K
Start a free trial

Private endpoints

Connect your services to AWS PrivateLink endpoints to eliminate public internet exposure

With Tiger Cloud, you can connect your services to AWS PrivateLink endpoints. A private endpoint in your VPC routes traffic to your service over the AWS backbone, without crossing the public internet or requiring VPC peering. This page describes how to create a private endpoint on the AWS side, claim it in Tiger Console, and attach a service to it.

Prerequisites for this procedure

To follow these steps, you'll need:

Set up a private endpoint connection

Section titled “Set up a private endpoint connection”

Take the following steps to connect your Tiger Cloud service to a PrivateLink endpoint.

  1. Copy the alias for your region

    1. In Tiger Console, select Security > Private Endpoints > Manage endpoints.

    2. Under Create the endpoint, copy the Alias for the region in which you need to create the connection. Choose the region of your AWS resources.

      Copying the region alias in the Manage endpoints panel
  2. Create a VPC endpoint in AWS

    1. In AWS Console, go to VPC > Endpoints > Create endpoint.

    2. Optionally provide a name tag for your endpoint.

    3. Under Type, select PrivateLink Ready partner services.

      AWS create endpoint settings

    4. Under Service settings > Service name, paste in the alias your copied in Tiger Console and click Verify service. Wait for the Service name verified. success message.

      AWS endpoint service settings

    5. Select the VPC that contains the resources you want to connect to Tiger Cloud, then choose one or more Availability Zones and subnets where the endpoint's private IPs will be created. For lowest latency and no cross-AZ data transfer charges, match the Availability Zones of your workloads; select multiple AZs for high availability.

    6. Optionally configure the security groups and tags, then click Create endpoint.

    7. Copy the VPC endpoint ID of your new endpoint. You claim the connection with this ID:

      The VPC endpoint ID of a new AWS endpoint

    8. Go to EC2 > Network interfaces and copy the primary private IPv4 address of your endpoint:

      The primary private IPv4 address of an AWS network interface
  3. Claim the connection

    1. In Tiger Console > Security > Private Endpoints, click Manage endpoints.

    2. Under Claim it, paste your VPC endpoint ID into Endpoint identifier, then click Claim connection. Tiger Cloud links the connection to the project you are working in, and it appears in the list.

      Claiming a private endpoint connection with the endpoint identifier
      Note

      You can claim a VPC endpoint against one project only.

      Your VPC endpoint ID can also take a minute to become claimable after you create the endpoint in AWS.

  4. Configure and attach

    1. Under IP Address click Add IP and paste the private endpoint IP address you have copied from AWS.

    2. Under Services click Attach service. Select your service from the dropdown and click Attach. You can attach a service to one private endpoint.

      A private endpoint connection with an IP address and an attached service

    3. From an EC2 instance inside your VPC, connect to your service using a connection string with your connection details. You should be able to connect successfully.

Manage connections

Section titled “Manage connections”
  • To detach a service from a private endpoint connection, go to Security > Private Endpoints, expand the arrow in the Services column, and click the trash icon next to the service connection string.
  • To edit or remove an endpoint connection, go to Security > Private Endpoints and click the three dots next to the connection in the list. Select Edit or Disconnect, respectively. You need to detach all services from a private endpoint connection before deleting it.