Docs

PrivateLink

Endpoint

Creating an interface endpoint

Prerequisites

Ensure that the service consumer has created a VPC and its subnets. For detailed actions, see Creating a Virtual Private Cloud.

Ensure the service provider's account has already created an endpoint service. For detailed actions, see Creating an endpoint service.

When an interface endpoint and its endpoint service reside under different accounts, the service provider must have added the account creating the endpoint to the endpoint service's allowlist. For detailed actions, see Adding an endpoint service allowlist.

Action notes

The maximum number of interface endpoints that can be created by a single account in a single region is 500. If the default quota cannot meet your needs, go to Quota Center to increase the corresponding quota.

The maximum number of interface endpoints that can be created in a single VPC is 50. If the default quota cannot meet your needs, go to Quota Center to increase the corresponding quota.

The maximum number of security groups that can be associated with a single endpoint is 5.

Procedures

Use the service consumer account to log in to the Endpoint console.

Accounts that have not completed cross-service role authorization must follow the steps below to grant the required role.

On the Cross-service access request page, click Authorize.

tip

The authorized role will be displayed in the role list of the Identity and Access Management (IAM) platform. Deleting the authorized role may cause cross-service access failures. Proceed with caution.

If the authorization role is deleted and you need to continue using the PrivateLink service, you must re-authorize the role.

In the left navigation tree, click Endpoint again.

In the top menu bar, select the target project and region.

On the Interface Endpoint tab, click Create Endpoint and configure the parameters as shown in the table below.

Parameters	Notes	Example
Basic information
Region	Select the region of endpoint.	cn-shanghai
Name	Enter the name of endpoint.	endpoint-1
Type	Select the type of endpoint. The interface endpoint is an elastic network interface with a private IP address from the subnet, capable of forwarding access traffic to the attached endpoint service. Suitable for scenarios requiring shared access to service resources in VPCs, whether within the same account or across different accounts.	Interface
Project	Select the project to which the endpoint belongs. When no project is specified, the endpoint belongs to the default project "default". Endpoints cannot be shared across different projects. Once a project is selected, the created endpoint will be accessible only to users with permissions for that project. For more information about the project feature for endpoints, see Project management.	default
Endpoint service
Enable cross-region	Enable cross-region. After enabled, the endpoint can connect to endpoint services in a different region.	Enable
Service region	Select the region where the endpoint service to which the endpoint needs to connect is located. Notes If the region involves cross-border traffic, the account must have cross-border qualifications. For details, see Cross-border service overview.	China (Guangzhou)
Add method	Select the method for associating an endpoint service. Choose how to specify the Endpoint service based on your needs. Add by Service Name: Enter the target endpoint service name (contact the service provider to obtain this). Enter the name and click Verify next to the input box to confirm if the name is correct. If verification fails, see Why does verification fail when entering the endpoint service name when creating an endpoint? for troubleshooting. Select available services: Choose from endpoint services under your account in the current region, as well as all cross-account endpoint services for which authorization has been completed. If using an IAM user, you may be unable to select available endpoint services. Refer to Why can't I select an available endpoint service when creating an endpoint? for resolution. VolcanoEngine Service: Supports selecting endpoint services provided by official VolcanoEngine services. For example, to select an endpoint service provided by Torch Object Storage (TOS)Object Storage, choose this option. tip To create an interface endpoint that supports IPv6, ensure the selected endpoint service supports IPv6.	Add by service name, com.volces.privatelink.cn-guangzhou.epsvc-2fe630gurkl37k5gfuy33****
Payer account	The billing account for the PrivateLink service is specified by the payer account of the endpoint service and cannot be modified. tip If the payer account is the endpoint service account, when the endpoint service is reclaimed due to overdue payments, the associated endpoint will also be deleted. If the publish region of the endpoint service involves cross-border traffic, the account must have cross-border qualifications. For details, see Cross-border service overview.	Endpoint Account
Network Configuration
VPC	Select the VPC to which the endpoint belongs from the dropdown.	vpc-2
IP address type	Select the IP address type of the endpoint. Select only IPv4: Indicates that the endpoint supports only IPv4. Select both IPv4 and IPv6: Indicates that the endpoint supports both IPv4 and IPv6. Select only IPv6: Indicates that the endpoint supports only IPv6. tip The PrivateLink IPv6 feature is currently in Beta stage. For trial requests, please contact your account manager. If you need to enable both IPv4 and IPv6, ensure the following conditions are met: The selected endpoint service supports IPv6. The selected VPC has IPv6 CIDR enabled and contains at least one subnet with IPv6 CIDR configured.	IPv4
Availability zone and subnet	Select the availability zone and subnet for the endpoint. You can only select availability zones that are supported by the endpoint service mentioned above. After the subnet is selected, the system will automatically create an endpoint network interface within the subnet. IP address allocation method: Auto-assign: The system automatically assigns an unused IP address from the selected subnet. Custom-assign: Manually enter an unused IP address from the selected subnet. Assign IP address: If the IP type is IPv4, assign an IPv4 address. If the IP type is both IPv4 and IPv6, assign one IPv4 address and one IPv6 address. If the IP type is IPv6, assign an IPv6 address.	Availability Zone A, subnet01 \| Auto-assign IP, 192.168.3.0/24
Security group	Select the security group(s) to be associated with the endpoint's network interface. If the above VPC is a shared VPC, the security group must be created by the current account; shared security groups cannot be selected. Ensure that the security group associated with the endpoint network interface allows traffic from 100.64.0.0/10 and fd00:64::/32, because health check requests for PrivateLink originate from these two CIDR blocks.	Default-sg
Advanced options
Private DNS name	Enable Private DNS Name to assign a custom domain name for accessing the endpoint. An endpoint can only enable its DNS name if the associated endpoint service has DNS enabled and internet domain verification has passed. After enabled, the private DNS name defaults to the private DNS name configured for the endpoint service. You can access the endpoint service using this private DNS name. For detailed actions on enabling and verifying the private DNS name of an endpoint service, see Modifying or verifying a Private DNS Name.	Disable
Tag	A tag consists of a key-value pair and is used for categorizing and searching resources For more information, see Tag management. Click Add tag, enter the tag key and tag value to add a tag to the interface endpoint.	Tag key: ep-key Tag value: ep-test

Depending on the payer account, select the appropriate steps to create the interface endpoint.

The payer account is the Endpoint account

Click Confirm order according to the console instructions to review and confirm the Legal.

Click Agree and buy to complete the action.

Click Go to console to view the created interface endpoint instances.

The payer account is the Endpoint Service account

Click Buy now to complete the action.

What to do next

After the endpoint is successfully created, it automatically sends a connection request to its associated endpoint service. The endpoint can only access its associated endpoint service via the private connection after this connection request is accepted by the service provider.

If the endpoint cannot successfully access its associated endpoint service after creation, contact the service provider for resolution.