Skip to main content

AWS PrivateLink

Most users of SpiceDB Dedicated privately connect to SpiceDB with AWS PrivateLink. PrivateLink enables private connections from your AWS accounts and VPCs to SpiceDB Permissions Systems in your SpiceDB Dedicated environment. Users of SpiceDB Dedicated can also have their SpiceDB Permissions Systems configured for access over the open internet.

Network Diagram

Prerequisites

Before you can start using SpiceDB Dedicated, you'll need to get in touch with the AuthZed team.

Step 1: Configure the VPC Endpoint

  1. In your AWS management console for the account you want to connect to SpiceDB Dedicated, navigate to VPC → Endpoints → Create Endpoint and input the following info:
OptionSelection
Name tagChoose whatever you want
Service categorySelect “Other endpoint services”
Service nameEnter the "service name" provided to you by the AuthZed team
VPCChoose the VPC from where you will deploy your SpiceDB client. DNS resolution for your SpiceDB cluster endpoint address will only be available from this VPC.
SubnetsYou can deploy your VPC endpoint in one subnet per AZ. We recommend choosing all AZs where SpiceDB clients will exist.
IP address typeIPV4
Security GroupChoose a security group that allows inbound port 443 traffic from your clients
  1. Click Create endpoint

Step 2: Enable DNS

  1. Navigate to the Endpoint you just created
  2. Select the Actions drop down and then select Modify private DNS name from the dropdown
  3. Check Enable for this endpoint
  4. Click Save changes

Verifying Connectivity

Step 3: Add a Permissions System

You can skip this section if you've already created a SpiceDB Permissions System.

  1. Login to your SpiceDB management console
  2. On the homepage, select Add Permissions System
  3. Configure your permission system to your liking and create it

Step 4: Verify Connectivity

To quickly verify connectivity from client machine with the Zed CLI tool

zed context set permission_system_name example.com:443 sdbst_h256_123

zed schema write example.yaml

zed schema read

If everything works, you should see a SpiceDB Schema in your terminal.