Docs

PrivateLink

Quick start

Implementing private access between VPCs across accounts

Scenario examples

This topic describes the detailed configuration for enabling Elastic Compute Services (ECSs) in the endpoint's VPC to access service resources in the endpoint service across different accounts.

Prerequisites

Ensure you have completed the preparatory steps outlined in the Quick start.

Configuration procedures

tip

The following steps only describe the parameters required for the configuration in this document. For parameters not mentioned, keep the default values.

Step 1: Create endpoint service

Only accounts that have not completed cross-service role authorization need to perform this. If already authorized, ignore this step.

On the Cross-service access request page, click Authorize.

The authorized role will be displayed in the role list of the Identity and Access Management (IAM) platform. Deleting the authorized role may cause cross-service access failures. Proceed with caution.

If the authorization role is deleted and you need to continue using the PrivateLink service, you must re-authorize the role.

In the left-side navigation pane, click Endpoint Service again.

In the top menu bar, select the target project and region.

Click Create Endpoint Service and see the table below to configure the relevant parameters.

Parameter	Explanation	Example
Basic information
Regions	Select the region to which the endpoint service belongs.	China (Guangzhou)
Name	The name of the endpoint service does not need to be filled in manually. Once the endpoint service is created successfully, the system automatically generates it in the format of com.volces.privatelink.<regionID>.<endpointserviceID>.	--
Service Resource
Topic	Select the service resource type provided by the endpoint service.	CLB
Service Resource	Select the CLB instance(s) to be used as the service resource(s).	CLB01
Advanced option
Auto accept connection	Auto-accept endpoint connection Yes: Automatically accept connection requests from endpoints. No: If No is selected, after the endpoint is created, you must manually accept the connection request from the endpoint. For the procedure, see Accepting an endpoint connection.	Yes

Click Create to complete the action.

Locate and record the Name of the successfully created endpoint service, as you will need it in Step 3: Create endpoint.

Step 2: Add allowlist

Click the target endpoint service, and select Allowlist tab.

Click Add allowlist, and configure the allowlist according to the table below.

Parameter
Explanation
Example
Allowlist range
Select the allowlist range of endpoint service.
Specified Account
Account ID
Enter the ID of account A.
210000****

Click Add to complete the action.

Step 3: Create endpoint

Follow the steps below to complete cross-service role authorization.

Only accounts that have not completed cross-service role authorization need to perform this. If already authorized, ignore this step.

On the Cross-service access request page, click Authorize.

The authorized role will be displayed in the role list of the Identity and Access Management (IAM) platform. Deleting the authorized role may cause cross-service access failures. Proceed with caution.

If the authorization role is deleted and you need to continue using the PrivateLink service, you must re-authorize the role.

In the left-side navigation pane, click Endpoint again.

On the Interface Endpoint tab, click Create Endpoint, and configure the relevant parameters as per the table below.

Parameter	Explanation	Example
Basic information
Regions	Select the region of endpoint.	China (Guangzhou)
Name	Enter the name of endpoint.	endpoint01
Topic	Select the type of endpoint.	Interface
Endpoint Service
Add method	Select the method for associating an endpoint service. It supports two methods: Add by Service Name and Select available service.	Select available service
Endpoint Service	Select the endpoint service created in Step 1.	com.volces.privatelink.cn-guangzhou.epsvc-2fe630gurkl37k5gfuy33****
Network Configuration
VPC	Select the VPC to which the endpoint belongs. The VPC selected here must be different from the VPC to which the endpoint service's associated service resource belongs.	VPC01
AZs and Subnets	Check the box for the Availability Zones of the endpoint service where you need to establish connections and select the corresponding subnet for each. After a subnet is selected, the system will automatically create an endpoint network interface for you.	Availability zone A, subnet01, Auto-assign IP
Security group	Select the security group(s) to be associated with the endpoint's network interface.	Default-sg

Click Buy now. Follow the console guidance to review and accept the Legal.

Click Buy now to check whether the creation is successful.

view and record the created Endpoint Domain. This will be needed in Step 4: Test connectivity.

Step 4: Test connectivity

tip

Before performing the following verification, ensure that the backend server for the CLB instance of the service resource is configured with the backend service. The procedure can be found in Configuring the backend service.

Remotely log in to the Elastic Compute Service (ECS) in VPC01. For specific actions, see Logging in to a Linux instance.

Execute the curl http://endpoint domain:listener port command to test network connectivity.

For example, if the endpoint domain is ep-2fegvybuk2yv459gp68nbk2e7.epsvc-2fegvxu3a2h3459gp67rdzvhe.cn-guangzhou.privatelink.volces.com and the service resource CLB instance's listener port is 80, then execute: curl http://ep-2fegvybuk2yv459gp68nbk2e7.epsvc-2fegvxu3a2h3459gp67rdzvhe.cn-guangzhou.privatelink.volces.com:80.

If the returned result displays the content of the backend service page configured on the backend server, it indicates successful network connectivity.

Last updated: 2026.06.29 18:20:25