Repository: PrefectHQ/prefect
Pull request: Adds AWS PrivateLink documentation
<!-- 
Thanks for opening a pull request to Prefect! 
If this is your first contribution, please make sure to review our contribution guidelines: https://docs.prefect.io/contribute/index
-->

<!-- Include an overview of the proposed changes here -->

### Checklist
<!-- These boxes may be checked after opening the pull request. -->

Adds new PrivateLink documentation to the `Manage Accounts` page
- [x] This pull request references any related issue by including "closes `<link to issue>`"
  - Closes https://github.com/PrefectHQ/prefect/issues/17071
- [ ] If this pull request adds new functionality, it includes unit tests that cover the changes
- [ ] If this pull request removes docs files, it includes redirect settings in `mint.json`.
- [ ] If this pull request adds functions or classes, it includes helpful docstrings.


Problem statement:
Add Documentation for AWS PrivateLink
### Describe the current behavior

Newly added support for AWS PrivateLink, creating an issue to reference in docs

### Describe the proposed behavior

Documentation updated to reflect PrivateLink support and instructions 

### Example Use

_No response_

### Additional context

_No response_

Hints from issue discussion:

Commit message: add page to sidebar

Patch to review:
diff --git a/docs/mint.json b/docs/mint.json
index 18e3fb0fd78d..392651b369cd 100644
--- a/docs/mint.json
+++ b/docs/mint.json
@@ -231,7 +231,8 @@
                 "v3/manage/cloud/manage-users/configure-sso",
                 "v3/manage/cloud/manage-users/audit-logs",
                 "v3/manage/cloud/manage-users/object-access-control-lists",
-                "v3/manage/cloud/manage-users/secure-access-by-ip-address"
+                "v3/manage/cloud/manage-users/secure-access-by-ip-address",
+                "v3/manage/cloud/manage-users/secure-access-by-private-link"
               ],
               "version": "v3"
             },
diff --git a/docs/v3/manage/cloud/index.mdx b/docs/v3/manage/cloud/index.mdx
index 036ee323a743..3bc8727b082e 100644
--- a/docs/v3/manage/cloud/index.mdx
+++ b/docs/v3/manage/cloud/index.mdx
@@ -21,6 +21,7 @@ The **Manage accounts** subsection covers aspects of Prefect Cloud accounts:
 - [Audit Cloud activity](/v3/manage/cloud/manage-users/audit-logs/) shows how Prefect provides a record of user activities to monitor for security and compliance. <span class="badge pro"></span> <span class="badge enterprise"></span>
 - [Object access control lists](/v3/manage/cloud/manage-users/object-access-control-lists/) (ACLs) allow privileged users to restrict deployment and block access to individual users. <span class="badge enterprise"></span> 
 - [Secure access by IP](/v3/manage/cloud/manage-users/secure-access-by-ip-address/) shows how to restrict access to Prefect Cloud by IP address. <span class="badge enterprise"></span>
+- [Secure access by PrivateLink](/v3/manage/cloud/manage-users/secure-access-by-private-link/) How to restrict access to Prefect Cloud by PrivateLink. <span class="badge enterprise"></span>
 
 The remaining Prefect Cloud pages in this section cover various aspects of Prefect Cloud:
 
diff --git a/docs/v3/manage/cloud/manage-users/secure-access-by-private-link.mdx b/docs/v3/manage/cloud/manage-users/secure-access-by-private-link.mdx
new file mode 100644
index 000000000000..288421989c03
--- /dev/null
+++ b/docs/v3/manage/cloud/manage-users/secure-access-by-private-link.mdx
@@ -0,0 +1,36 @@
+---
+title: Secure access over PrivateLink
+description: Manage network access to Prefect Cloud accounts over PrivateLink.
+---
+
+PrivateLink is an available upgrade to certain Enterprise plans.  
+PrivateLink enables account administrators to restrict access to Prefect Cloud APIs and the UI at the network level, by routing all network traffic through AWS and GCP.  
+Traffic between your network and Prefect Cloud is encrypted, and does not traverse the public internet.  
+
+To learn more, please contact your account manager or the Prefect team at sales@prefect.io.
+
+Your Prefect team will provide the service endpoint to register.
+Once registered, the following information is required to accept the connection on Prefects side:
+
+- AWS Account Number for each AWS registering
+- AWS VPC IDs for each registering endpoint
+- Source Region for each VPC (`us-east-1`, `us-east-2` etc.)
+- VPC Endpoint ID for each registered/pending endpoint
+
+Prefect will match your pending connection to the information provided, and once approved accept the connection.
+
+Once accepted, customers should enable "Modify Private DNS" to ensure the VPCs can resolve the Prefect service endpoint.
+
+With Private DNS and the accepted connection, connectivity can be validated through curl:
+
+```bash
+curl -i https://api-internal.private.prefect.cloud/api/health
+```
+
+To configure the Prefect client, and/or workers to use the endpoint, `PREFECT_API_URL` and `PREFECT_CLOUD_API_URL` should be set to the endpoint provided by Prefect.
+
+```bash
+prefect config set PREFECT_API_URL=https://api-internal.private.prefect.cloud/api/accounts/<account-id>/workspaces/<workspace-id>
+prefect config set PREFECT_CLOUD_API_URL=https://api-internal.private.prefect.cloud/api
+```
+


Code review comments:
diff_hunk: @@ -0,0 +1,36 @@
+---
+title: Secure access over PrivateLink
+description: Manage network access to Prefect Cloud accounts over PrivateLink.
+---
+
+PrivateLink is an available upgrade to certain Enterprise plans.  
+PrivateLink enables account administrators to restrict access to Prefect Cloud APIs and the UI at the network level, by routing all network traffic through AWS and GCP.  
+Traffic between your network and Prefect Cloud is encrypted, and does not traverse the public internet.  
+
+To learn more, please contact your account manager or the Prefect team at sales@prefect.io.
+
+Your Prefect team will provide the service endpoint to register.
+Once registered, the following information is required to accept the connection on Prefects side:
+
+- AWS Account Number for each AWS registering
+- AWS VPC IDs for each registering endpoint
+- Source Region for each VPC (`us-east-1`, `us-east-2` etc.)
+- VPC Endpoint ID for each registered/pending endpoint
+
+Prefect will match your pending connection to the information provided, and once approved accept the connection.
+
+Once accepted, customers should enable "Modify Private DNS" to ensure the VPCs can resolve the Prefect service endpoint.
+
+With Private DNS and the accepted connection, connectivity can be validated through curl:
+
+```bash
+curl -i https://api-internal.private.prefect.cloud/api/health
+```
+
+To configure the Prefect client, and/or workers to use the endpoint, `PREFECT_API_URL` and `PREFECT_CLOUD_API_URL` should be set to the endpoint provided by Prefect.
path: docs/v3/manage/cloud/manage-users/secure-access-by-private-link.mdx
text: @user1:
```suggestion
To configure Prefect clients and/or workers to use the endpoint, `PREFECT_API_URL` and `PREFECT_CLOUD_API_URL` should be set to the endpoint provided by Prefect.
```