# Connect to Foundry via AWS PrivateLink [AWS PrivateLink ↗](https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-privatelink.html) allows users to access Foundry via a private AWS network without traversing the public Internet. AWS Private Link supports connections between different VPCs (virtual private clouds) regions, though cross-region support may have additional limitations; contact your Palantir representative with the desired `(start_region, destination_region)` combination to verify support. AWS PrivateLink is an AWS service. ## Ingress to Foundry for AWS PrivateLink Traffic can flow from a customer's Virtual Private Cloud (VPC) to the Foundry VPC using the AWS backbone network. PrivateLink traffic and open Internet traffic to Foundry are supported at the same time by [configuring additional IP whitelists using Control Panel](../../administration/configure-ingress/index.md). ### Set up ingress to Foundry for AWS PrivateLink 1. Send your [AWS account ID ↗](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-identifiers.html#FindAccountId) to your Palantir representative. 2. Palantir sends back the VPC Endpoint Service Name. Example of a VPC Endpoint Service Name: `com.amazonaws.vpce..vpce-svc-<18_CHARACTER_UID>`. 3. Create a VPC Endpoint in the AWS Console under **VPC > Endpoints > Create Endpoint**. a. Optionally, add a name tag for your endpoint. b. Select **Other endpoint services**. c. In the **Service Category** section, paste the Palantir Endpoint Service Name and select **Verify service**. d. Fill in the rest of the details of the VPC, Subnets, and Security Groups that you want to connect to Foundry via Private Link. The Security Group should allow connection to Foundry on port 443 (HTTPS). e. Select **Create Endpoint** at the bottom of the page to create a new Endpoint. 4. Provide your newly created Endpoint ID (found in the Endpoints section of the AWS VPC dashboard) and the AWS region of the endpoint, as well as your Foundry Enrollment ID and the Organization ID(s) for every organization that should have access via the Private Link, to your Palantir representative. The Foundry Enrollment IDs and Organization IDs can be found in [Control Panel](../../administration/control-panel/index.md). *Screenshot of Foundry Enrollment ID in the Foundry Control Panel:* ![Screenshot of Foundry Enrollment ID found in the Foundry Control Panel](../../../assets/e2c199798c6c34c4fdab9b5cd5c11bad5b0091fd9b1ce06916d316903435b26a.webp) 5. Add a DNS entry (CName or A-Record) that points the Foundry domain to the VPC Endpoint Universal DNS name. If you are doing this within AWS, it is recommended to create an A-Record *alias* in Route53 as shown in the [AWS documentation for routing to a VPC Endpoint with Route53 ↗](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-vpc-interface-endpoint.html). You can find the Universal DNS name under **DNS names** in the **Endpoints** section of the AWS VPC dashboard. 6. (Conditional) If the Foundry domain is *owned by you* (meaning that the domain is *not* a Palantir-owned domain such as `*.palantirfoundry.com`), there is additional configuration needed to funnel internal Foundry services through the endpoint as well; these steps are described in the documentation on [customer-owned private links](../customer-owned-domain-private-link/index.md). 7. Refresh and clear your browser cache, and all traffic from your VPC to Foundry will be routed through the private link instead of the public Internet. ## Egress from Foundry for AWS PrivateLink Traffic that occurs from Foundry to other AWS VPCs can also be configured to be routed through the AWS backbone instead of the public Internet, even if the Foundry instance's VPC and the target VPC are in different AWS regions. Some AWS services support sending all traffic via the AWS backbone *without extra AWS costs of using a custom PrivateLink*, by using [AWS Gateway Endpoints ↗](https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html). The AWS services currently supported are: * **S3:** You can set up an AWS Gateway Endpoint for S3 directly in Foundry Control Panel by [creating an S3 bucket same-region policy](../../administration/configure-egress/index.md#amazon-s3-bucket-policies). * **DynamoDB:** Contact your Palantir representative to set up an AWS Gateway Endpoint for DynamoDB. For all other AWS services or any other types of traffic, a PrivateLink (VPC Endpoint) must be set up in AWS and configured in Foundry. This setup process is fully self-service and is described in the [documentation on private link egress](../../administration/configure-private-link-egress/index.md). ## FAQ ### I get an "Unable to verify service name" error when creating a VPC Endpoint. Ensure that you sent the correct AWS Account ID to your Palantir representative in the first step. If the account ID starts with zeroes, these still need to be included in the ID. ### Can Palantir give me an AWS federated token? No; you must use Palantir's Endpoint Service name to create a VPC Endpoint as described in steps 1-3 of the [guide to setting up ingress to Foundry](#set-up-ingress-to-foundry-for-aws-privatelink). ### Is it possible to connect my non-Foundry VPC to Foundry's VPC via VPC Peering? No, VPC peering with a non-Palantir network is not supported; we suggest using a Private Link instead as described in the documentation on this page. ### Is it possible to set up a cross-region Private Link between my non-Foundry VPC and my Foundry instance? Yes, AWS PrivateLink supports cross-region Private Links. See the [ingress](#ingress-to-foundry-for-aws-privatelink) and [egress](#egress-from-foundry-for-aws-privatelink) instructions above to establish this connection.