How it works

Service provider

As the service owner, a service provider uses Alibaba Cloud resources to build and offer an endpoint service to service consumers. Service consumers access the service through an endpoint associated with the endpoint service.

• Service resources: An endpoint service can use load balancers deployed across multiple availability zones as service resources. Supported service resource types include Network Load Balancer (NLB), Application Load Balancer (ALB), Classic Load Balancer (CLB), and Gateway Load Balancer (GWLB).

• Endpoint service name: This is the unique identifier for an endpoint service. A service consumer uses this name to specify the target service when creating an endpoint.

• Service whitelist: An endpoint service is not visible to all service consumers by default. If a service provider wants to allow a VPC in another Alibaba Cloud account to access the endpoint service, they must add that account ID to the service whitelist.

  After an endpoint service is created, the service provider's account is automatically added to the service whitelist.

• Endpoint service status: Creating, Modifying, Available, or Deleting.

Service consumer

A service consumer creates an endpoint to access an endpoint service from a VPC or an on-premises data center.

• Endpoint type: The service consumer creates an endpoint of a specific type based on the endpoint service they want to access.

  A gateway endpoint does not rely on PrivateLink. It acts as a virtual gateway for a VPC to access specific cloud services, using the reserved address space 100.64.0.0/10 and endpoint policies for more secure access. Currently, Object Storage Service (OSS) is the only cloud service that supports gateway endpoints.

  • Interface endpoint: A service consumer uses an interface endpoint to access an endpoint service whose service resources are NLB, CLB, or ALB instances.

  • Gateway Load Balancer endpoint: A service consumer uses a Gateway Load Balancer endpoint to access an endpoint service that uses a GWLB instance as its service resource. A Gateway Load Balancer endpoint can be configured as the next hop in a VPC route table to direct traffic.

  • Reverse endpoint: This allows a service provider to initiate access to cloud services within the service consumer's VPC. The service consumer can restrict the access scope by configuring a security group on the reverse endpoint. Reverse endpoints can connect only to endpoint services for Alibaba Cloud services.

• Endpoint availability zone: When a service consumer creates an endpoint, PrivateLink creates an elastic network interface (ENI) in the specified endpoint availability zone to act as the local entry point for the service.

• Endpoint policy: You can configure an endpoint policy for an interface endpoint only when you use it to access an Alibaba Cloud service. By default, any user or service within the VPC with valid Alibaba Cloud account credentials can access any resource in the corresponding service.

• Endpoint status: Creating, Modifying, Available, or Deleting.

Endpoint connection

When a service consumer creates an endpoint, the service provider's endpoint service receives a connection request. After the service provider accepts the request, an endpoint connection is established between the endpoint and the endpoint service.

An endpoint connection can have one of the following statuses: Connecting, Connected, Disconnecting, Disconnected, Modifying, Deleting, or Service Deleted.

A connection can be in the Disconnected state for the following reasons:

• The endpoint service is not configured for automatic connection acceptance. After the endpoint is created, its status is Disconnected.

• The endpoint service has rejected the connection request from the endpoint, or the service has not yet approved the connection.

• The endpoint has an overdue payment.

• The endpoint service has an overdue payment.

Endpoint service domain name

When a service consumer creates an interface endpoint, Alibaba Cloud generates regional and zonal service domain names for connecting to the service:

• Endpoint service domain name: endpoint_id.endpoint_service_id.service_region.privatelink.aliyuncs.com

  • endpoint_id: The ID of the endpoint, automatically generated after the endpoint is created.

  • endpoint_service_id: The ID of the endpoint service.

  • service_region: The ID of the region where the service is located, such as cn-hangzhou.

  • privatelink.aliyuncs.com: A fixed domain suffix.

• Zonal domain name: endpoint_id-endpoint_zone.endpoint_service_id.service_region.privatelink.aliyuncs.com

  • endpoint_zone: The ID of the endpoint availability zone, such as cn-hangzhou-j.

  • -: A hyphen that separates the endpoint ID and the availability zone ID.

When you access Alibaba Cloud services in a VPC, you typically use a specific service domain name. If the service is configured with a custom service domain name, you can enable it for the interface endpoint you create. This allows you to continue using the domain name to access the service over PrivateLink, eliminating the need to modify your application's service address.

A custom service domain name is effective only within the VPC where the interface endpoint is located. Only this VPC can resolve the domain name to a private IP address. Other VPCs and on-premises data centers can use the custom service domain name to access the service after they connect to the endpoint's VPC and configure DNS resolution.

IP versions

A service provider can offer an endpoint service to a service consumer using IPv4 or dual-stack.

• Dual-stack can be selected only if all service resources associated with the endpoint service support dual-stack.

• If an endpoint service supports dual-stack, a service consumer can create a dual-stack endpoint. This allows clients to access the service using both IPv4 and IPv6.

1. The service provider configures service resources for the endpoint service across multiple availability zones.

   • If the service resources are NLB or ALB instances, add instances that span multiple availability zones.

   • If the service resource is a CLB instance, add multiple instances with different primary availability zones.

2. When creating an interface endpoint, the service consumer selects vSwitches in at least two availability zones.

3. The service consumer uses the endpoint domain name to access the service. Alibaba Cloud provides fully managed health checks to fail over rapidly to other availability zones if one fails:

   • The system continuously monitors the health of the ENI IP addresses in different endpoint availability zones. If the system detects an anomaly, it removes the corresponding DNS record to prevent service interruptions or data loss.

   • After the issue is resolved, the system automatically restores the DNS record.

Elastic performance

PrivateLink supports automatic elastic scaling:

• It provides automatic scaling at the availability zone level. The bandwidth supported by each endpoint in each availability zone automatically increases with business growth.

• It provides specific elastic limits based on the endpoint type and service resource type.

• The elastic bandwidth metric reflects only the capacity of the ENIs in the endpoint's availability zones. The actual full-link capacity depends on the backend service resource type and the application's processing capability.

If your application requires higher throughput, contact your account manager.

Elastic bandwidth and throttling

• Elastic bandwidth: The system's automatic scaling capability at the availability zone level. It represents the maximum bandwidth an endpoint can support within each availability zone without requiring manual configuration.

• Throttling: A traffic control policy configured by the service provider for an endpoint connection to prevent overloading backend service resources. The service provider can set different throttling values for different endpoint connections.

  • Inheritance mechanism: When the service provider sets a throttling value for an endpoint connection, the ENIs of the endpoint in each availability zone automatically inherit and enforce this value, enabling precise traffic control.

  • How to view:

    • Call GetVpcEndpointAttribute and check the Bandwidth information in the response.

    • On the endpoint details page, view Bandwidth Limit in the Basic Information section.

Single-flow performance limits

To ensure performance and stability, PrivateLink uses a distributed high-reliability cluster architecture within each endpoint availability zone. Traffic is evenly distributed across multiple devices in the cluster for forwarding. As a result, the bandwidth of a single flow is limited by the performance of a single device. The elastic bandwidth metric and throttling value can reach their maximum limits only when multiple flows are used.

Additionally, PrivateLink is an end-to-end private network connection. The actual full-link capacity also depends on the backend service resource type and the application's processing capability. Moreover, because throttling policies are independently enforced on each device, the actual throttling value may exceed the configured limit. We recommend that you conduct stress tests and configure monitoring based on your business requirements. When performance exceeds the maximum metric, your business traffic may experience packet loss.