Docs

Message Queue for RocketMQ

Connections

Accessing RocketMQ instances through PrivateLink

This topic explains how to access a RocketMQ instance across virtual private clouds (VPCs) using PrivateLink.

Background information

PrivateLink establishes private connections through endpoints and endpoint services, enabling private access to service resources across VPCs. This provides a more secure network solution by avoiding the risks of exposing data to the Internet. For more information, see What is PrivateLink.

When you create a RocketMQ 5.x instance and select a VPC for private access, the instance is only accessible within the VPC by default. There is network isolation between different VPCs. However, cross-VPC access to a RocketMQ instance is often necessary for business purposes. To meet these requirements, you can either enable public access for the instance or use PrivateLink. While public access offers limited bandwidth and lower security, PrivateLink provides higher security.

Only RocketMQ 5.x instances support PrivateLink.

Related concepts

Concept	Description
Endpoint service	A service provider creates and manages an endpoint service that offers external parties a private endpoint bound to specific service resources.
Endpoint	A service consumer creates an endpoint within their own VPC to connect to the desired endpoint service.
Whitelist	If the service consumer is using a different account than the service provider, add the consumer's account to the whitelist for the endpoint service to which they want to connect.

Workflow

The service provider creates an endpoint service for the desired RocketMQ instance to enable PrivateLink connectivity.

(Optional) If the service consumer is using a different account than the service provider, add the consumer's account to the whitelist for the endpoint service.

The service consumer creates an endpoint and associates it with the endpoint service.

The service consumer then accesses the instance through the endpoint.

Prerequisites

A RocketMQ 5.x instance has been created. For instructions, see Creating instances.

Both the service provider's and the service consumer's VPCs are ready and within the same region.

The VPC, subnet, and security group necessary for the service consumer to access the instance are in place.

Steps for service providers

Create an endpoint service for the desired instance.

You can enable PrivateLink connectivity by creating an endpoint service. There are two ways to do this.

RocketMQ console
API
Log in to Message Queue for RocketMQ console with the account of the service provider.
In the top menu bar, select the region of the instance you want to manage.
On the Instance List page, click the name of the instance.
On the Basic information tab, locate the Service access section. Then, click Start end point service under End point node service.
In the Start end point service dialog box, click OK.
Record the instance ID. You will need it for later steps.
Use the CreatePrivateLink API to enable PrivateLink connectivity for the instance and generate an endpoint service ID (PrivateLinkId).
tip
Save the generated endpoint service ID. You will need it for later steps.

(Optional) Configure the whitelist for the endpoint service.

tip

This step is only necessary if the service provider and service consumer are using different accounts.

If they are using the same account, this step is unnecessary.

Add the service consumer's account to the whitelist for the endpoint service so they can select the service when creating an endpoint. There are two ways to add accounts to the whitelist.

RocketMQ console
API
Log in to Message Queue for RocketMQ console with the account of the service provider.
In the top menu bar, select the region of the instance you want to manage.
On the Instance List page, click the name of the instance.
On the Basic information tab, locate the Service access section. Then, click configuration whitelist under End point node service.
In the configuration whitelist panel, enter the account ID of the service consumer.
Click add. Successfully added accounts will appear in the list below.
tip
To remove an account from the whitelist, click Delete in the Operation column.
Use the AddPLWhitelist API to add an account to the whitelist for the endpoint service.
tip
Use the DescribePLWhitelist API to view the accounts that have been added to the whitelist.
Use the RemovePLWhitelist API to remove accounts from the whitelist.

Steps for service consumers

Create an endpoint.

There are two ways you can create an endpoint and associate it with the service provider's endpoint service.

PrivateLink console

API

Complete cross-service role authorization if this process has not been completed for this account.

On the Cross-service access request page, click Authorize.

tip

The authorized role will appear in the Identity and Access Management (IAM) role list. Deleting the authorized role will disable cross-service access, so proceed with caution.

If you delete the authorized role and want to continue using PrivateLink, reauthorize the role.

In the left navigation pane, click Endpoint again.

In the top menu bar, select the project and region where the instance resides.

On the Endpoint page, select the Interface Endpoint tab.

On the Interface Endpoint page, click Create Endpoint.

On the Create Endpoint page, configure the following parameters.

tip

The following table only lists the key parameters. For descriptions of other parameters, see Creating an interface endpoint.

Parameter	Description
Region	Select the region where the instance you want to access is located.
Type	Select Interface.
Add method	Select Select available service.
Endpoint Service	In the Select Endpoint Service panel, select the endpoint service associated with the instance. Enter the endpoint service ID (PrivateLinkId), obtained from the Steps for service providers section, into the input box. Alternatively, you can search using the instance ID in the input box.
VPC	Select the VPC that you will use to access the instance.
Availability Zone and Subnet	Select the availability zone and subnet for the endpoint. After the subnet is selected, the system will automatically create an endpoint network interface within the subnet.
Security Group	Select one or more security groups with which the endpoint's network interface will be associated.

Follow the instructions on the page to complete the next steps.

On the Interface Endpoint tab, check the status of the endpoint's network interface. Make sure the network interface is created successfully, and then obtain the endpoint’s domain name. For more information, see Viewing endpoint details.

Access the instance through the endpoint.

Once the endpoint has been created and the connection has been established, you can access the instance within your own VPC by using the endpoint's domain name.

Related operations

Disabling PrivateLink

If you no longer need PrivateLink connectivity, first reject the endpoint connection or delete the endpoint. Then, use the DeletePrivateLink API to delete the PrivateLink endpoint service.

Viewing monitoring data

PrivateLink allows you to view monitoring data for endpoint services and endpoints. For instructions, see View monitoring data.

Last updated: 2026.09.02 16:07:46