Connect to Google Cloud Private Service Connect with the DevOps API

To better protect your database connection, you can connect to a private endpoint using the Astra DB private endpoint. Private endpoints are available for only intra-region use. The region for your private endpoint in the Google Cloud Console and your Astra DB database must match.

For pricing related to using private endpoints, see Pricing and billing.

The following roles can manage private endpoints:

Organization Administrator
Database Administrator

Alternatively, you can use a custom role with permissions to manage private endpoints.

For more, see Google Cloud Private Service Connect.

Prerequisites

Create your Astra DB database using Astra Portal.
Ensure you have permission to manage private endpoints.
Get your application token.
From your Google Cloud Console, get your Project ID. For example, valiant-ocean-258751.
Create a Google Cloud Console network, subnetwork, and IP address for your private endpoint. For more, see Creating neworks.

To increase your security, restrict public access to your database using the access list.

If you are using Postman for your API calls, ensure you use the raw option to enter the body of your API call.

Connect to your Google Cloud Private Service Connect endpoint

Enter the Project ID as your allowed principal for your private endpoints to Astra DB:

cURL command (/v2)
Result

curl --request POST \
  --url 'https://api.astra.datastax.com/v2/organizations/clusters/<databaseID>/datacenters/<datacenterID>/private-link' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer <application_token>' \
  --data '{
      "allowedPrincipals": [
        "valiant-ocean-258751"
      ]
    }'

To confirm your datacenter ID, see your database Dashboard or use the DevOps API to get all datacenter IDs within your database.

{
  "serviceName": "projects/<projectID>/regions/<regionName>/serviceAttachments/<serviceAttachmentName>",
  "allowedPrincipals": [
    "valiant-ocean-258751"
  ]
}

Create the endpoint in your Google Cloud Console.
1. In the Google Cloud Console, go to Private Service Connect.
2. Select Connect endpoint.
3. Select Published service as the Target.
4. Enter the 'serviceName' from the DevOps API result as the Target service.
5. Enter a name for the Endpoint name.
6. Select your Network and Subnetwork for the endpoint.
7. Select an IP address for the endpoint.
8. Select Add endpoint.
The status for the endpoint will show as Accepted. This does not mean that the endpoint is ready for use and must be accepted in the Astra DB DevOps API.

Using the PSC Connection ID from your Google Cloud Console as your endpoint ID, accept your Google Cloud private endpoint connection:

cURL command (/v2)
Result

curl --request POST \
  --url 'https://api.astra.datastax.com/v2/organizations/clusters/<databaseID>/datacenters/<datacenterID>/endpoints' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer <application_token>' \
  --data '{
      "endpointID": "2755639674399101",
      "description": "project-desc-dev-app"
    }'
.sh[]

{
  "datacenters": [
    {
      "serviceName": "projects/<projectID>/regions/<regionName>/serviceAttachments/<serviceAttachmentName>",
      "allowedPrincipals": [
        "valiant-ocean-258751"
      ],
      "datacenterID": "string",
      "endpoints": [
        {
          "endpointID": "2755639674399101",
          "description": "project-desc-dev-app",
          "status": "Accepted",
          "createdDateTime": "2021-04-10T23:00:00"
        }
      ]
    }
  ]
}

Your Google Private Service Connect menu will show the private endpoint.

Create a DNS entry for your private endpoint.
1. Download your secure connect bundle for the region of your choice. Get your latest secure connect bundle.
2. Unzip the secure connect bundle.
3. In config.json, copy the host key’s value.
4. In the Google Cloud Console, create a private zone to route traffic to your endpoint IP. Update the following domains to use REST and CQL:
  REST
  
  CQL
  
  efe451fe-709e-4700-9185-5cf0fd3474a7-2-us-east-1.apps.astra.datastax.com
  
  efe451fe-709e-4700-9185-5cf0fd3474a7-2-us-east-1.db.astra.datastax.com
  For more, see Create a private zone.

You can now connect to your private endpoint using your updated secure connect bundle. For more, see Drivers for Astra.

Remove a private endpoint

Delete a private endpoint from your Astra DB:

cURL command (/v2)

curl --request DELETE \
  --url 'https://api.astra.datastax.com/v2/organizations/clusters/<databaseID>/datacenters/<datacenterID>/endpoints/<endpointID>' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer <application_token>'

In the Google Cloud Console, go to Private Service Connect.
Select the endpoint you want to remove.
Select Delete.

What’s next?

Private Service Connect
DevOps API reference
Learn how to Manage access lists for public access.