Manage private endpoints with the DevOps API
You can use private endpoints to establish a secure connection between your cloud provider and your Astra DB Classic databases. With a private endpoint, all communication remains within the private network, ensuring that no information is transmitted over the public internet.
Each of your Astra DB databases can connect to one or more private endpoints:
-
Single endpoint: Create a private endpoint in your virtual private cloud (VPC) and use it for one database.
-
Multiple endpoints: Create multiple private endpoints in your VPC and use them for the same database.
Private endpoints have cost implications. For information about private endpoint pricing, see the plan details on the Astra DB pricing page.
Prerequisites
-
An active Astra DB Classic database.
-
Access to AWS PrivateLink or Google Cloud Private Service Connect.
-
Permission to create network resources, such as VPCs, subnets, and private endpoints, in your cloud provider.
Private endpoints must exist in the same region and cloud provider as the databases that use them. For example, a database in AWS
us-west-2
can only use AWS PrivateLink private endpoints inus-west-2
. -
An application token with the Organization Administrator or Database Administrator role.
Get existing private endpoint configurations
You can get information about existing private endpoint configurations for all databases in your organization, a single database, or a single region of a multi-region database.
-
Get private endpoints for all databases
-
Get private endpoints for one database
-
Get private endpoints for one region
curl --request GET \
--url 'https://api.astra.datastax.com/v2/organizations/<organizationID>/clusters/private-link' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer <application_token>'
curl --request GET \
--url 'https://api.astra.datastax.com/v2/organizations/clusters/<databaseId>/private-link' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer <application_token>'
If the database is not a multi-region database, then the datacenterID
is is the same as the databaseID
.
curl --request GET \
--url 'https://api.astra.datastax.com/v2/organizations/clusters/*DATABASE_ID*/datacenters/*DATACENTER_ID/private-link' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer *APPLICATION_TOKEN*'
Responses
A successful response includes information about private endpoint configurations, depending on the request:
-
Information for all databases in an organization. If there are any multi-region databases, the response includes all regions.
{ "clusters": [ { "clusterID": "string", "datacenters": [ { "serviceName": "com.amazonaws.vpce.us-east-1.vpce-svc-1148ea04af491da11", "allowedPrincipals": [ "arn:aws:iam::123456789012:role/admin" ], "datacenterID": "string", "endpoints": [ { "endpointID": "vpce-svc-1148ea04af491da11", "description": "ecomm-team-billing-app", "linkID": "126845687", "status": "Accepted", "createdDateTime": "2009-11-10T23:00:00" } ] } ] } ] }
-
Information for one database. For a multi-region database, the response includes all regions.
{ "clusterID": "string", "datacenters": [ { "serviceName": "com.amazonaws.vpce.us-east-1.vpce-svc-1148ea04af491da11", "allowedPrincipals": [ "arn:aws:iam::123456789012:role/admin" ], "datacenterID": "string", "endpoints": [ { "endpointID": "vpce-svc-1148ea04af491da11", "description": "ecomm-team-billing-app", "linkID": "126845687", "status": "Accepted", "createdDateTime": "2009-11-10T23:00:00" } ] } ] }
-
Information for one region of one database:
{ "serviceName": "com.amazonaws.vpce.us-east-1.vpce-svc-1148ea04af491da11", "allowedPrincipals": [ "arn:aws:iam::123456789012:role/admin" ], "datacenterID": "string", "endpoints": [ { "endpointID": "vpce-svc-1148ea04af491da11", "description": "ecomm-team-billing-app", "linkID": "126845687", "status": "Accepted", "createdDateTime": "2009-11-10T23:00:00" } ] }
Add private endpoints
Astra DB Classic supports AWS PrivateLink and Google Cloud Private Service Connect endpoints.
This page explains how to configure private endpoints with the DevOps API. You can also use the Astra Portal.
Enable private endpoints
-
To enable private endpoints in Astra DB, you need to set the allowed principal for each database and region where you want to use private endpoints:
curl --request POST \ --url 'https://api.astra.datastax.com/v2/organizations/clusters/*DATABASE_ID*/datacenters/*DATACENTER_ID*/private-link' \ --header 'Accept: application/json' \ --header 'Authorization: Bearer *APPLICATION_TOKEN*' \ --data '{ "allowedPrincipals": [ "*ALLOWED_PRINCIPAL*" ] }'
Replace the following:
-
DATABASE_ID
: The database identifier. -
DATACENTER_ID
: The region identifier. The region must correspond to the cloud provider you identify in theallowedPrincipals
.To get the datacenter ID, you can use the DevOps API List datacenters endpoint.
-
APPLICATION_TOKEN
: Your application token. -
ALLOWED_PRINCIPAL
:-
For AWS-based databases, the allowed principal is your AWS account’s Amazon Resource Name (ARN) in the format
arn:aws:iam::AWS-ACCOUNT-ID:root
. For more information, see Principals for gateway endpoints. -
For Google Cloud-based databases, the allowed principal is your Google Cloud Project ID.
-
-
-
Get the
serviceName
from the response. You need it to create the private endpoint.-
AWS
-
Google Cloud
{ "serviceName": "com.amazonaws.vpce.*REGION*.vpce-svc-*SERVICE_ID*", "allowedPrincipals": [ "*ARN*" ] }
{ "serviceName": "projects/*PROJECT_ID*/regions/*REGION_NAME*/serviceAttachments/*SERVICE_ATTACHMENT_NAME*", "allowedPrincipals": [ "*GOOGLE_CLOUD_PROJECT_ID*" ] }
-
You have now allowed one region of one database to use private endpoints from the cloud provider identified in the allowedPrincipals
.
For multi-region databases, you must enable private endpoints for each region where you want to use private endpoints.
Create a private endpoint
After enabling private endpoints for a database, create a private endpoint in your cloud provider, and then connect it to the database.
-
AWS
-
Google Cloud
For AWS-based databases, use an AWS PrivateLink private endpoint:
-
Sign in to the AWS VPC dashboard, and then switch to your database’s region.
-
Create an endpoint to connect to an endpoint service as the service consumer.
The VPC endpoint’s Service name is the
serviceName
generated when you enabled private endpoints. -
After creating the endpoint, copy the VPC Endpoint ID.
-
Connect your private endpoint to your database (
DATABASE_ID
) and region (DATACENTER_ID
):curl --request POST \ --url 'https://api.astra.datastax.com/v2/organizations/clusters/*DATABASE_ID*/datacenters/*DATACENTER_ID*/endpoints' \ --header 'Accept: application/json' \ --header 'Authorization: Bearer *APPLICATION_TOKEN*' \ --data '{ "endpointID": "*VPC_ENDPOINT_ID*", "description": "*OPTIONAL_STRING*" }'
Response
A successful response contains the private endpoint configuration for the specified database and region. Make sure the
status
isAccepted
.{ "datacenters": [ { "serviceName": "com.amazonaws.vpce.*REGION*.vpce-svc-*SERVICE_ID*", "allowedPrincipals": [ "*ARN*" ], "datacenterID": "*DB_REGION_ID*", "endpoints": [ { "endpointID": "*VPC_ENDPOINT_ID*", "description": "*OPTIONAL_ID*", "status": "Accepted", "createdDateTime": "2021-04-10T23:00:00" } ] } ] }
For Google Cloud-based databases, use a Google Cloud Private Service Connect private endpoint:
-
Sign in to the Google Cloud Network Services console.
-
Create an endpoint to access published services.
The VPC endpoint’s Target service is the
serviceName
generated when you enabled private endpoints. -
After creating the endpoint, copy the PSC Connection ID from the endpoint details.
-
Connect your private endpoint to your database (
DATABASE_ID
) and region (DATACENTER_ID
):curl --request POST \ --url 'https://api.astra.datastax.com/v2/organizations/clusters/*DATABASE_ID*/datacenters/*DATACENTER_ID*/endpoints' \ --header 'Accept: application/json' \ --header 'Authorization: Bearer *APPLICATION_TOKEN*' \ --data '{ "endpointID": "*PSC_CONNECTION_ID*", "description": "*OPTIONAL_STRING*" }'
Response
A successful response contains the private endpoint configuration for the specified database and region. Make sure the
status
isAccepted
.{ "datacenters": [ { "serviceName": "projects/*PROJECT_ID*/regions/*REGION_NAME*/serviceAttachments/*SERVICE_ATTACHMENT_NAME*", "allowedPrincipals": [ "*GOOGLE_CLOUD_PROJECT_ID*" ], "datacenterID": "*DB_REGION_ID*", "endpoints": [ { "endpointID": "*PSC_CONNECTION_ID*", "description": "*OPTIONAL_STRING*", "status": "Accepted", "createdDateTime": "2021-04-10T23:00:00" } ] } ] }
Your database is now connected to a private endpoint. Next, configure DNS mapping.
Create DNS entries for a private endpoint
To ensure proper name resolution for private endpoints, you must configure private DNS mapping for the *.astra.datastax.com
domain and subdomains.
This overrides the default resolution to the public IP address provided by Astra DB.
If you use a private endpoint for one database, then you must configure private DNS mapping for every database you create, whether it uses a private endpoint or not. |
-
AWS
-
Google Cloud
-
In Amazon Route 53, create a private hosted zone to route the
astra.datastax.com
domain traffic to your AWS PrivateLink VPC ID. -
Create alias records to route Astra DB subdomains to your Amazon VPC interface endpoint’s DNS name.
DataStax recommends alias records for Astra DB Classic databases because they are compatible with DataStax drivers.
For each database, you must create records for both the
.db.
and.apps.
domains:-
DATABASE_ID-REGION.db.astra.datastax.com
-
DATABASE_ID-REGION.apps.astra.datastax.com
For multi-region databases, you must create these entries for every region where you use private endpoints.
-
-
Recommended: In the Astra Portal, use the IP Access List to block all public internet traffic to the database. This makes the database available only through private endpoints and allowed IPs.
-
In the Google Cloud console, create a private zone to route traffic to your Private Service Connect endpoint IP.
-
Create Type A standard records for Astra DB subdomains.
For each database, you must create records for both the
.db.
and.apps.
domains:-
DATABASE_ID-REGION.db.astra.datastax.com
-
DATABASE_ID-REGION.apps.astra.datastax.com
For multi-region databases, you must create these entries for every region where you use private endpoints.
-
-
Recommended: In the Astra Portal, use the IP Access List to block all public internet traffic to the database. This makes the database available only through private endpoints and allowed IPs.
After you configure private endpoints, you might need to update SCB connection details for any drivers, applications, scripts, or otherwise that use the SCB to connect to your database.
Connect to a database through multiple private endpoints
You can access one database from multiple private endpoints. The private endpoints must have the same region and cloud provider as the database. For multi-region databases, you must create private endpoints in each applicable region.
To connect to one database through multiple private endpoints, Enable private endpoints, Create all private endpoints, and Add a DNS entry for each VPC where you deployed a private endpoint.
Delete a private endpoint
To delete a private endpoint, you must delete the private endpoint from Astra DB and your cloud provider:
-
Delete the private endpoint from Astra DB. The DELETE request removes one endpoint from one region of one database.
curl --request DELETE \ --url 'https://api.astra.datastax.com/v2/organizations/clusters/*DATABASE_ID*/datacenters/*DATACENTER_ID*/endpoints/*ENDPOINT_ID*' \ --header 'Accept: application/json' \ --header 'Authorization: Bearer *APPLICATION_TOKEN*'
-
Remove the private endpoint from your cloud provider:
-
Remove or modify private DNS mapping as needed.
When you delete a private endpoint, make sure you delete the connection in both the Astra Portal and your cloud provider. |