Use a VPC Private Endpoint (Preview)

Create a VPC Interface Endpoint

1. In the App Services UI, navigate to App Settings, then click the Private Endpoints tab.

2. Click Add Private Endpoint, then click General.

3. Add your VPC ID and Subnet IDs (comma-separated list) in their separate fields, then click Next.

4. Copy the generated VPC Interface Endpoint Command. The command should look something like this:

   aws ec2 create-vpc-endpoint \
     --vpc-endpoint-type Interface
     --service-name <App Services Endpoint Service Name> \
     --vpc-id <your-vpc-id> \
     --region <your-aws-deployment-region> \
     --subnet-ids <your-subnet-ids>

5. In your terminal, execute the generated AWS CLI command to create a VPC Endpoint.

Add the Private Endpoint to Your App

Now that you've created the interface endpoint in your VPC, you need to add it to your App.

1. Find the VPC Endpoint ID, either in the output of the CLI command you ran in the previous step or on the endpoint details screen of the AWS VPC dashboard. This value starts with vpce-.

2. Copy your new VPC Endpoint's ID and paste it into the Your VPC Endpoint ID field in the App Services UI, then click Next.

3. If this is the first Private Endpoint you are creating, you will see a toggle you can use to either restrict or open all access from requests outside your PrivateLink connection. By default, App Services blocks all requests coming from outside your PrivateLink connection. This setting applies to this endpoint and all additional endpoints you create. Refer to change access restrictions for more information.

4. Click Finish Endpoint Creation.

Create a VPC Interface Endpoint

1. Call the List VPC Private Endpoint Services endpoint.

2. Filter the response object to find the entry for your App's deployment region and the endpoint type you want to create.

   curl https://services.cloud.mongodb.com/api/admin/v3.0/groups/{groupId}/apps/{appId}/security/private_endpoint_service_infos \
   -H "Authorization: Bearer <access_token>"

   HIDE OUTPUT

   [
   {
      "cloud_provider_region": "aws-us-east-1",
      "service_name": "com.amazonaws.vpce.us-east-1.vpce-svc-0718bec2c0bdeab5c",
      "endpoint_type": "general"
   },
   ...
   ]

3. Get the service_name field from the desired entry in the previous step.

4. Create a VPC Endpoint using the AWS CLI create-vpc-endpoint command. You need an App Services endpoint service name, VPC ID, subnet IDs, and AWS deployment region. The command should look something like this:

aws ec2 create-vpc-endpoint \
  --vpc-endpoint-type Interface
  --service-name <App Services Endpoint Service Name> \
  --vpc-id <your-vpc-id> \
  --region <your-aws-deployment-region> \
  --subnet-ids <your-subnet-ids>

Add the Private Endpoint to Your App

Now that you've created the interface endpoint in your VPC, you need to add it to your App.

1. Find the VPC Endpoint ID, either in the output of the CLI command you ran in the previous step or on the endpoint details screen of the AWS VPC dashboard. This value starts with vpce-.

2. When you have your VPC Endpoint's ID, call Create a VPC Private Endpoint with the Endpoint ID, cloud deployment region, and endpoint type. For example, using aws-us-east-1:

curl https://services.cloud.mongodb.com/api/admin/v3.0/groups/{groupId}/apps/{appId}/security/private_endpoints \
  -X POST \
  -H "Authorization: Bearer <accessToken>" \
  -H "Content-Type: application/json" \
  -d '{
    "cloud_provider_region": "<your-cloud-deployment-region>",
    "cloud_provider_endpoint_id": "<your-vpc-endpoint-id>",
    "endpoint_type": "general",
    "comment": "Optional: add a comment describing the endpoint."
  }'

Create a VPC Interface Endpoint

1. In the App Services UI, navigate to App Settings and then click the Private Endpoints tab.

2. Click Add Private Endpoint, then click Sync.

3. Add your VPC ID and Subnet IDs (comma-separated list) in their separate fields, then click Next.

4. Copy the generated VPC Interface Endpoint Command. The command should look something like this:

   aws ec2 create-vpc-endpoint \
     --vpc-endpoint-type Interface
     --service-name <App Services Endpoint Service Name> \
     --vpc-id <your-vpc-id> \
     --region <your-aws-deployment-region> \
     --subnet-ids <your-subnet-ids>

5. In your terminal, execute the generated AWS CLI command to create a VPC Endpoint.

6. You must also create a General Endpoint using the command App Services generates.

Add the Private Endpoints to Your App

Now that you've created the interface endpoints in your VPC, you need to add them to your App.

1. Find the Sync and General VPC Endpoint IDs, either in the output of the CLI commands you ran in the previous step or on the endpoint details screen of the AWS VPC dashboard. This value starts with vpce-.

2. Copy your new VPC Endpoint IDs and paste them into their respective Your VPC Endpoint ID field in the App Services UI, then click Next.

3. If this is the first Private Endpoint you are creating, you will see a toggle you can use to either restrict or open all access from requests outside your PrivateLink connection. By default, App Services blocks all requests coming from outside your PrivateLink connection. This setting applies to this endpoint and all additional endpoints you create. Refer to change access restrictions for more information.

4. You must also create a General Private Endpoint by following the steps for creating a General Private Endpoint on this page.

5. Click Finish Endpoint Creation.

Create a VPC Interface Endpoint

1. Call the List VPC Private Endpoint Services endpoint.

2. Filter the response object to find the entry for your App's deployment region and the endpoint type you want to create.

   curl https://services.cloud.mongodb.com/api/admin/v3.0/groups/{groupId}/apps/{appId}/security/private_endpoint_service_infos \
   -H "Authorization: Bearer <access_token>"

   HIDE OUTPUT

   [
   {
      "cloud_provider_region": "aws-us-east-1",
      "service_name": "com.amazonaws.vpce.us-east-1.vpce-svc-0718bec2c0bdeab5c",
      "endpoint_type": "sync"
   },
   ...
   ]

3. Get the service_name field from the desired entry in the previous step.

4. Create a VPC Endpoint using the AWS CLI create-vpc-endpoint command. You need an App Services endpoint service name, VPC ID, subnet IDs, and AWS deployment region. The command should look something like this:

aws ec2 create-vpc-endpoint \
  --vpc-endpoint-type Interface
  --service-name <App Services Endpoint Service Name> \
  --vpc-id <your-vpc-id> \
  --region <your-aws-deployment-region> \
  --subnet-ids <your-subnet-ids>

Add the Private Endpoint to Your App

Now that you've created the interface endpoint in your VPC, you need to add it to your App.

1. Find the Sync VPC Endpoint ID, either in the output of the CLI commands you ran in the previous step or on the endpoint details screen of the AWS VPC dashboard. This value starts with vpce-.

2. Create a Sync Private Endpoint by calling Create a VPC Private Endpoint with its Endpoint ID, cloud deployment region, and endpoint type. For example, using aws-us-east-1:

   curl https://services.cloud.mongodb.com/api/admin/v3.0/groups/{groupId}/apps/{appId}/security/private_endpoints \
   -X POST \
   -H "Authorization: Bearer <accessToken>" \
   -H "Content-Type: application/json" \
   -d '{
      "cloud_provider_region": "<your-cloud-deployment-region>",
      "cloud_provider_endpoint_id": "<your-vpc-endpoint-id>",
      "endpoint_type": "sync",
      "comment": "Optional: add a comment describing the endpoint."
   }'

3. You must also create a General Private Endpoint by following the steps for creating a General Private Endpoint on this page.