Chapter 7. Red Hat Ansible Automation Platform Service on AWS Private Link Connectivity

Procedure

1. To request Ingress PrivateLink submit a Customer support case to Red Hat using the Ingress AWS PrivateLink request template step 2.

2. You must include your:

   • AWS Account ID.
   • Region.
   • Deployment URL.
   • After Red Hat provides you with a VPC Endpoint Service Name, you must create a VPC Endpoint in your AWS account that points to the provided service name.

3. For your Ingress AWS PrivateLink request template:

   • Select "Endpoint services that use NLBs and GWLBs".

     • In the Service name field, paste the VPC Endpoint Service Name provided by Red Hat and click Verify service.

   • Complete the network and security group configuration as required by your organization.

     Subject:
     Request for Ingress PrivateLink Connection: <Your Company Name> - <Deployment ID>
     
     Body:
     Hello Red Hat Support,
     
     We would like to enable Ingress PrivateLink connectivity for our AAP on AWS instance. This will allow our internal users and automation tools to access the AAP Control Plane (UI/API) securely from our VPC without traversing the public internet.
     
     Deployment details:
     AAP Deployment Name/ID: <for example., ans-123456>
     AAP Deployment URL: <for example, https://ans-123456.ansible.redhat.com>
     Our Network Information:
     Our AWS Account ID: <Your 12-digit AWS Account ID>
     Target Region: <for example, us-east-1>
     
     Action required:
     Please create the Endpoint Service configuration on the Control Plane side and provide us with the VPC Endpoint Service Name so we can create the interface endpoint in our VPC.
     
     Thank you.

Procedure

1. Create an Endpoint Service in your VPC:

   1. Confirm your private resource is behind an AWS Network Load Balancer (NLB).

   2. Create an Endpoint Service in your AWS VPC that points to that NLB.

      Important

      You must select the service type that supports Interface endpoints and enable the Private DNS option.

2. To initiate control plane egress, you must submit a separate Customer support case using the Egress PrivateLink request template.
3. Red Hat uses the information provided to create an Interface Endpoint on their side. When Red Hat creates this endpoint, they select the category "Endpoint services that use NLBs and GWLBs" to connect to your service.
4. Your Internal Network or IT Team must configure the Internal DNS.
5. To ensure users route through the secure PrivateLink connection, you must request a Split-Horizon DNS configuration.
6. Copy the Egress PrivateLink request template, fill in your specific VPC Endpoint Service Name, and submit it to Red Hat.