Chapter 7. Red Hat Ansible Automation Platform Service on AWS Private Link Connectivity Private link connectivity is a networking feature commonly used in cloud environments. Private link connectivity allows services to communicate privately over a secure, internal network without exposing traffic to the public internet. On AWS, private link connectivity is known as AWS PrivateLink. 7.1. Key benefits of private link connectivity Enables the Ansible Automation Platform Service on AWS control plane to connect to project and execution environment repositories hosted on private networks that are inaccessible from the public internet. Keeps automation mesh data within a private network rather than traversing the public internet. Note Automation mesh uses industry standard TLS encryption regardless of how automation mesh nodes are connected. Consider this traffic secured in the same manner as all TLS traffic. 7.2. How AWS PrivateLink works AWS PrivateLink connectivity is supported both into (ingress) and out of (egress) the Ansible Automation Platform control plane. For more AWS specific information about how AWS PrivateLink works, see the Amazon Virtual Private Cloud documentation. 7.2.1. AWS PrivateLink connectivity into the Ansible Automation Platform control plane For AWS PrivateLink connectivity into the control plane, an AWS Endpoint Service has automatically provisioned AWS PrivateLink connectivity into the control plane in your AWS environment. You must create an AWS Endpoint to connect to this service in your Virtual Private Cloud (VPC), and enable private DNS resolution of the endpoint service hostname. With this in place, any traffic originating from your VPC to the control plane API or mesh ingress connects to a private IP address and does not traverse the public internet. Traffic is stateful, so there is no need to open a private link in the reverse direction for responses to Transmission Control Protocol (TCP) requests that originate from the customer VPC 7.2.2. AWS PrivateLink connectivity out of the Ansible Automation Platform control plane To enable AWS PrivateLink connectivity from the control plane to your private resources, create one or more Endpoint Services in your VPC and work with Red Hat to create the consuming Endpoints. With this in place, the Ansible Automation Platform control plane can connect privately to your resources such as registries, repositories, and execution nodes. Traffic is stateful, so there is no need to open a private link in the reverse direction for responses to Transmission Control Protocol (TCP) requests that originate from the control plane VPC. 7.3. Enabling AWS PrivateLink connectivity To enable private link connectivity, submit a customer support ticket and the Red Hat team will assist you with steps. Note You must create two support tickets for bi-directional connectivity: one support case for enabling AWS PrivateLink connectivity into the control plane and another one for enabling AWS PrivateLink connectivity out of the control plane. Procedure Navigate to Customer support . The fields auto-fill, however confirm: The Account field displays your customer account The Owner field displays your login The Product field displays Red Hat Ansible Automation Platform On Clouds The Version field displays AWS - Managed Service Select Configuration for the What can we help you with? section. Click Continue . Use the values in the following templates to copy values into the Title and Describe your problem sections of the support request. Title: Ansible Automation Platform Service on AWS PrivateLink Template Describe your problem: Enable AWS PrivateLink connectivity from control plane to customer's network Endpoint Service references are for the Endpoint Service created in the customer's VPC. Endpoint Service name: <enter here> Endpoint Service AWS region: <enter here> Endpoint Service ports or port ranges: <enter here> Title: Ansible Automation Platform Service on AWS PrivateLink Template Describe your problem: Enable AWS PrivateLink connectivity from customer's network to control plane Customer AWS account ID: <enter here> Endpoint AWS region(s): <enter here> After Red Hat has configured the control plane Endpoint Service allowed principal and supported regions, a response will be added to your support ticket to create your Endpoint and share the Endpoint Service name, which you can find at https://console.redhat.com/ansible/service. Click Continue .

Commands:
Title: Ansible Automation Platform Service on AWS PrivateLink Template Describe your problem: Enable AWS PrivateLink connectivity from control plane to customer's network Endpoint Service references are for the Endpoint Service created in the customer's VPC. Endpoint Service name: <enter here> Endpoint Service AWS region: <enter here> Endpoint Service ports or port ranges: <enter here>
Title: Ansible Automation Platform Service on AWS PrivateLink Template Describe your problem: Enable AWS PrivateLink connectivity from customer's network to control plane Customer AWS account ID: <enter here> Endpoint AWS region(s): <enter here> After Red Hat has configured the control plane Endpoint Service allowed principal and supported regions, a response will be added to your support ticket to create your Endpoint and share the Endpoint Service name, which you can find at https://console.redhat.com/ansible/service.