> ## Documentation Index
> Fetch the complete documentation index at: https://docs.traversal.com/llms.txt
> Use this file to discover all available pages before exploring further.
# PrivateLink
> Establish AWS PrivateLink connections between your VPC and your dedicated Traversal deployment (single-tenant SaaS or BYOC) so traffic to Traversal services stays on the AWS private network.
AWS PrivateLink provides private connectivity between VPCs and services by keeping traffic on the AWS network backbone. It works through Interface Endpoints, eliminating the need for public IPs, internet gateways, or VPC peering. As a service provider (in the PrivateLink terminology), Traversal's dedicated deployments (single-tenant SaaS and BYOC) expose four endpoint services: its web application, API, Edge (for the Connector), and Ingest (for the Processor).
In a dedicated Traversal deployment, PrivateLink is how your VPCs reach Traversal's endpoints without exposing them to the public internet. After deploying the VPC endpoints in your VPC(s), Traversal-supplied hostnames resolve only inside VPCs you explicitly authorize, and the wildcard server certificate is issued by your own CA against a domain you own. For an architectural overview, see [single-tenant SaaS](/architecture/single-tenant-saas) or [Bring Your Own Cloud](/architecture/byoc).
You establish the connection by deploying a CloudFormation template that Traversal publishes. The template creates one VPC Interface Endpoint per service; you supply your own security groups and they are attached per endpoint, giving you independent access control per service. Each security group must allow inbound HTTPS (port 443) from the CIDR ranges or sources that need to reach that service. Each endpoint resolves a Traversal-supplied hostname to a private IP inside your VPC, keeping all traffic on the AWS network.
Multi-VPC access: Repeat the deployment steps in each VPC where Traversal services need to be reachable. Each VPC needs its own set of 4 Interface Endpoints and its own association with the private hosted zone.
## Before you begin
Traversal shares the following with you through a secure channel during onboarding of your dedicated deployment:
* **Endpoint Service names** — one per service (`api`, `app`, `edge`, `ingest`), in the form `com.amazonaws.vpce..vpce-svc-xxxxxxxxxxxxxxxxx`.
* **A Route53 private hosted zone ID** and its **four nameservers**.
* **The subdomain** that resolves the Traversal endpoints (for example, `traversal..com`).
On your side, you'll need:
* An AWS account, and a VPC where the Interface Endpoints will live.
* Subnet IDs in that VPC (one per AZ recommended).
* The CIDR ranges of every client network that should reach the endpoints.
* A parent zone you control where you can add a delegating `NS` record.
## DNS Resolution
Traversal creates a private Route53 hosted zone for a subdomain and shares four nameservers with you. You add an NS record on your parent zone pointing at those nameservers, delegating the subdomain to Traversal.
This lets Traversal use a subdomain you own, for example, `traversal..com`, so that Traversal service hostnames appear under your domain rather than a Traversal-owned one.
Traversal then populates the hosted zone with CNAME records pointing to your Interface Endpoint DNS names, which in turn resolve to the private IP of the endpoint inside your VPC. These hostnames only resolve inside VPCs that are associated with the hosted zone and are not resolvable from the public internet.
## Deployment
On your parent zone, add an `NS` record for your delegated subdomain pointing at the four nameservers Traversal shared with you.
Deploy the PrivateLink consumer CloudFormation template ([https://templates.traversal.com/traversal-privatelink-consumer.yaml](https://templates.traversal.com/traversal-privatelink-consumer.yaml)) in the AWS account and region where the Interface Endpoints will live. Pass the four `*EndpointServiceName` values Traversal shared with you, along with your VPC ID, subnet IDs, and the CIDR ranges of clients that should reach the endpoints.
The stack outputs include one DNS name per service (`ApiEndpointDnsName`, `AppEndpointDnsName`, `EdgeEndpointDnsName`, `IngestEndpointDnsName`).
Share your VPC IDs and regions with Traversal. Once Traversal authorizes them, run the following from your account for each VPC:
```bash theme={null}
aws route53 associate-vpc-with-hosted-zone \
--hosted-zone-id \
--vpc VPCRegion=,VPCId=
```
Share the four `*EndpointDnsName` outputs from the CloudFormation stack with Traversal. Traversal creates the CNAMEs in the private hosted zone so `.` resolves to your Interface Endpoint.
## DNS-only VPC access
If a VPC only needs to resolve Traversal hostnames but not connect directly to the endpoints — for example, an admin VPC — you can authorize it without deploying Interface Endpoints. Share the VPC IDs and regions with Traversal; we'll authorize them on our side. Then run the following from your account for each VPC:
```bash theme={null}
aws route53 associate-vpc-with-hosted-zone \
--hosted-zone-id \
--vpc VPCRegion=,VPCId=
```
Once associated, DNS queries for the Traversal subdomain resolve inside that VPC without Interface Endpoints.
## Want to learn more?
How Traversal single-tenant SaaS is deployed in Traversal's own cloud account, what's in scope, and the security boundary.
How Traversal BYOC is deployed in your AWS account, what's in scope, and the security boundary.
AWS documentation on PrivateLink, Interface Endpoints, and Endpoint Services.