Skip to main content
RisingWave Cloud utilizes the private connection capability of the underlying Cloud vendors to establish the PrivateLink connection. In particular, the PrivateLink service is built on top of the following services:
  • AWS PrivateLink
    When configuring AWS PrivateLink, ensure you’re using an IAM user or role with appropriate permissions. Never use the AWS account root user for these operations.
  • GCP Private Service Connect
  • Azure Private Link
    Azure Private Link integration is currently in development and will be available soon.
The diagram below depicts a high-level overview of how PrivateLink service works. All three platforms share the same pattern of network structure so that you can configure them in the same way automatically.
All data transmitted through PrivateLink connections is automatically encrypted in transit. Additionally:
  • For AWS PrivateLink: Communication is secured using AWS’s internal network and TLS encryption
  • For GCP Private Service Connect: Data is encrypted using Google’s internal network encryption
  • For Azure Private Link: Traffic is automatically encrypted within the Microsoft backbone network
On the RisingWave Cloud side, RisingWave Cloud will create an endpoint (specifically an AWS VPC endpoint, GCP Private Service Connect endpoint, or Azure private endpoint) and bind it with one running RisingWave project. On the Customer side, you need to set up a PrivateLink service (specifically an AWS endpoint service, GCP published service, or Azure Private Link service) in your VPC network first. In addition to connecting RisingWave Cloud to services in your VPC, RisingWave Cloud also supports a reverse path that lets you connect to RisingWave Cloud privately. This feature is called Serving PrivateLink on AWS and Serving Private Service Connect on GCP. On AWS, with Serving PrivateLink, RisingWave Cloud creates an AWS endpoint service. You then create an Interface VPC Endpoint in your AWS account to connect to it. All traffic between your VPC and RisingWave Cloud stays on the AWS internal network. On GCP, with Serving Private Service Connect, RisingWave Cloud publishes a service attachment. You create a Private Service Connect endpoint that targets the service attachment and configure private DNS for the endpoint. The Cloud Meta tab (in Network Access → Cloud Meta) exposes the provider-specific connection values:
  • For AWS, Endpoint Service Name and Private Endpoint (host:port).
  • For GCP, Service attachment URI, DNS suffix, and Private endpoint (host:port).
See Cloud metadata for instructions on using these fields. In the RisingWave Cloud Console, go to your project and click Network Access in the left sidebar. Then select the PrivateLink tab to create and manage PrivateLink connections.
When setting up an AWS endpoint service, add the PrivateLink principals from your project’s Cloud Meta tab (Cloud metadata) to the service’s allowed principals list so that RisingWave Cloud can connect.