Project: YugabyteDB (App Definition and Development / Database)
File: cloud-add-endpoint.md

title: Private service endpoints headerTitle: linkTitle: Private service endpoints description: Manage cluster private service endpoints. headcontent: Connect clusters to applications using a private link service menu: preview_yugabyte-cloud: identifier: cloud-add-endpoint parent: cloud-vpcs weight: 35 type: docs A private service endpoint (PSE) is used to connect a YugabyteDB Managed cluster that is deployed in a Virtual Private Cloud (VPC) with other services on the same cloud provider - typically a VPC hosting the application that you want to access your cluster. The PSE on your cluster connects to an endpoint on the VPC hosting your application over a private connection, referred to as a private link. While cloud providers refer to the components of a private link service in different ways, these components serve the same purposes. | YBM | AWS&nbsp;PrivateLink | Azure&nbsp;Private&nbsp;Link | Description | | : | : | : | : | | VPC | VPC | VNet | Secure virtual network created on a cloud provider. | | PSE | | | The endpoints on your cluster that you make available to the private link. | | Application VPC endpoint | | | The endpoints on the application VPC corresponding to the PSEs on your cluster. | Security principal | (ARN) | | Cloud provider account with permissions to manage endpoints. | | Service name | Service name | Alias | Identifies the PSE to the application VPC endpoint. You provide the service name when creating the application VPC endpoint. | Setting up a private link to connect your cluster to your application VPC involves the following tasks: Deploy your cluster in a VPC. You must create a VPC and deploy your cluster before you can configure the PSE. Create a PSE in each region of your cluster. The PSE is an endpoint service, and you activate it by granting access to a security principal on your application VPC. In the case of AWS, a security principal is an AWS principal, in the form of Amazon resource names (ARNs). For Azure, a security principal is a subscription ID of the service you want to have access. On the cloud provider, create an interface VPC endpoint (AWS) or a private endpoint (Azure) on the VPC (VNet) hosting your application. You create an endpoint for each region in your cluster, providing the service name of the corresponding PSE on your cluster. Currently, PSEs are supported for and . You can't use smart driver load balancing features when connecting to clusters over a private link. See . Before you can create a PSE, you need to do the following: Create a VPC. Refer to . Make sure your VPC is in the same region as the application VPC to which you will connect your endpoint. Deploy a YugabyteDB cluster in the VPC. Refer to . In addition, if you want to use to create PSEs, you need to do the following: Create an API key. Refer to . Install and configure ybm CLI. Refer to . Note that, unlike VPC peering, when connected to an application VPC using a private link, you do not need to add an to your cluster. {{< sections/2-boxes >}} {{< sections/bottom-image-box title="Set up an AWS PrivateLink" description="Add PSEs to your cluster and create interface endpoints on your application VPC in AWS." buttonText="Setup Guide" buttonUrl="../managed-endpoint-aws/" >}} {{< sections/bottom-image-box title="Set up an Azure Private Link" description="Add a PSE to your cluster and create a private endpoint on your application VNet in Azure." buttonText="Setup Guide" buttonUrl="../managed-endpoint-azure/" >}} {{< /sections/2-boxes >}}