You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Sep 2, 2025. It is now read-only.
@@ -30,6 +30,8 @@ Connect different accounts within or across regions
30
30
31
31
You can use AWS PrivateLink to connect different accounts in the same AWS region. The following diagram shows an overview of how AWS PrivateLink for Splunk Observability Cloud works:
32
32
33
+
NEW IMAGE TBC
34
+
33
35
.. image:: /_images/gdi/AWS_PL_region1.png
34
36
:width:80%
35
37
:alt:AWS Private Link schema.
@@ -52,7 +54,42 @@ You can use any of these endpoints with AWS PrivateLink:
See the following tables for the AWS PrivateLink endpoint URLs and service names for each AWS region.
57
+
See the following tables for information on the available AWS source account regions, AWS PrivateLink endpoint URLs and service names for each AWS region.
Reach out to Splunk Customer Support with the following information to include your AWS Account ID to the allow list:
243
+
Reach out to :ref:`Splunk Customer Support<support>` with the following information to include your AWS Account ID to the allow list:
205
244
206
245
* AWS Account ID
207
246
208
-
* AWS region
209
-
210
-
* Same region connectivity: If you're connecting in the same region, provide the service AWS region.
211
-
212
-
* Cross-region connectivity: If you're connecting between two regions you need to provide both the source (or customer) region and the target (or Observability Cloud account) region. The following regions are supported:
213
-
214
-
* US East (N. Virginia) ``us-east-1``
215
-
* US East (Ohio) ``us-east-2``
216
-
* US West (N. California) ``us-west-1``
217
-
* US West (Oregon) ``us-west-2``
218
-
* Africa (Cape Town) ``af-south-1``
219
-
* Asia Pacific (Hong Kong) ``ap-east-1``
220
-
* Asia Pacific (Hyderabad) ``ap-south-2``
221
-
* Asia Pacific (Jakarta) ``ap-southeast-3``
222
-
* Asia Pacific (Melbourne) ``ap-southeast-4``
223
-
* Asia Pacific (Mumbai) ``ap-south-1``
224
-
* Asia Pacific (Osaka) ``ap-northeast-3``
225
-
* Asia Pacific (Seoul) ``ap-northeast-2``
226
-
* Asia Pacific (Singapore) ``ap-southeast-1``
227
-
* Asia Pacific (Sydney) ``ap-southeast-2``
228
-
* Asia Pacific (Tokyo) ``ap-northeast-1``
229
-
* Canada (Central) ``ca-central-1``
230
-
* Canada West (Calgary) ``ca-west-1``
231
-
* Europe (Frankfurt) ``eu-central-1``
232
-
* Europe (Zurich) ``eu-central-2``
233
-
* Europe (Ireland) ``eu-west-1``
234
-
* Europe (London) ``eu-west-2``
235
-
* Europe (Paris) ``eu-west-3``
236
-
* Europe (Milan) ``eu-south-1``
237
-
* Europe (Stockholm) ``eu-north-1``
238
-
* Middle East (Bahrain) ``me-south-1``
239
-
* Middle East (UAE) ``me-central-1``
240
-
* South America (São Paulo) ``sa-east-1``
241
-
242
-
.. note:: If your workloads or Splunk Observability Cloud accounts are in regions not listed above, cross-region PrivateLink is not supported. In such cases, you should either use PrivateLink within the same AWS region or set up VPC peering.
243
-
244
247
* Endpoint type
245
248
246
249
* Ingest
247
250
* API
248
251
* Stream
249
252
250
-
Review the ways you can contact Splunk Customer Support at :ref:`Splunk Observability Cloud support <support>`.
253
+
* AWS source account region. Must be one of the regions listed in :ref:`aws-source-regions`.
254
+
255
+
* Splunk Observability AWS account region. Must be one of the regions listed in :ref:`aws-privatelink-service-names`.
256
+
257
+
The following applies:
258
+
259
+
* If you're setting up same-region PrivateLink connectivity, your AWS source account region is the same as the Splunk Observability AWS account region.
260
+
261
+
* If you're setting up cross-region PrivateLink connectivity, your AWS source account region is different from the Splunk Observability AWS account region.
262
+
263
+
.. caution:: If your workloads are deployed in AWS regions not listed in :ref:`aws-source-regions`, then cross-region PrivateLink connectivity is not supported. In such cases, you should consider setting up VPC peering as described in :ref:`aws-privatelink-vpc-peering`.
251
264
252
265
.. _aws-privatelink-step2:
253
266
254
-
Step 2: Verify AWS Account ID is added to allow list
.. caution:: Wait for Splunk Customer Support's confirmation that your AWS Account ID was added to the allow list before performing these steps. Support might take up to 24 hours.
258
271
259
272
To verify your AWS Account ID has been allowed, follow these steps:
260
273
261
-
1. Log in to the AWS Management Console, and open the :guilabel:`Amazon VPC service` in the specific region where you intend to set up AWS PrivateLink.
274
+
1. Log in to the AWS Management Console and open the :guilabel:`Amazon VPC service` in the specific region where you intend to set up AWS PrivateLink.
262
275
263
-
2. On the left navigation pane, select :guilabel:`PrivateLink and Lattice > Endpoints`, and select endpoint services that use NLBs and GWLBs.
276
+
2. On the left navigation pane, navigate to :guilabel:`PrivateLink and Lattice > Endpoints`.
264
277
265
-
3. Create the endpoint:
278
+
3. Select :guilabel:`Create endpoint`, then :guilabel:`Endpoint services that use NLBs and GWLBs`.
266
279
267
-
* Same region connectivity:
268
-
269
-
1. Enter and verify the service name based on the AWS region where you're configuring the VPC endpoint.
270
-
2. Identify the appropriate service name using the :ref:`AWS PrivateLink service names table <aws-privatelink-service-names>`.
280
+
4. Under :guilabel:`Service Settings`, enter the service name based on the AWS region where you're configuring the VPC endpoint. Identify the appropriate service name using the :ref:`AWS PrivateLink service names table <aws-privatelink-service-names>`.
271
281
272
-
* Cross-region connectivity:
273
-
274
-
1. Sepcify service name from the :ref:`AWS PrivateLink service names table <aws-privatelink-service-names>`.
275
-
2. Enable Cross Region endpoint checkbox and select the AWS region of the above selected service.
282
+
5. If you are setting up cross-region PrivateLink connectivity, check the :guilabel:`Enable Cross Region endpoint` checkbox. Based on the service name you used in point 4, select the appropriate Splunk Observability region.
276
283
277
284
.. image:: /_images/gdi/AWS_PL_region3.png
278
285
:width:80%
279
286
:alt:Verify account.
280
287
281
-
4. Ensure the service name is accurate by selecting :strong:`Verify Service`.
288
+
.. caution:: If you are setting up PrivateLink connectivity in the same region do not check the Enable Cross Region endpoint checkbox.
289
+
290
+
6. Select :strong:`Verify Service`.
282
291
283
292
* If you see the "Service name verified" message, proceed with :ref:`aws-privatelink-step3`.
284
293
@@ -291,64 +300,30 @@ Step 3: Create a VPC endpoint
291
300
292
301
To create a VPC endpoint, follow these steps:
293
302
294
-
1. Log in to the AWS Management Console, and open :guilabel:`Amazon VPC service` within the specific region where you intend to set up AWS PrivateLink. If you have a VPC peering configuration, keep in mind the destination region of VPC peering.
295
-
296
-
2. On the left navigation pane, select :guilabel:`PrivateLink and Lattice > Endpoints`, and select endpoint services that use NLBs and GWLBs.
297
-
298
-
3. Create the endpoint:
299
-
300
-
* Same region connectivity:
301
-
302
-
1. Enter and verify the service name based on the AWS region where you're configuring the VPC endpoint.
303
-
2. Identify the appropriate service name using the :ref:`AWS PrivateLink service names table <aws-privatelink-service-names>`.
304
-
305
-
* Cross-region connectivity:
306
-
307
-
1. Sepcify service name from the :ref:`AWS PrivateLink service names table <aws-privatelink-service-names>`.
308
-
2. Enable Cross Region endpoint checkbox and select the AWS region of the above selected service.
303
+
1. Under :guilabel:`Network settings` select the VPC where the endpoint will reside.
309
304
310
-
.. image:: /_images/gdi/AWS_PL_region3.png
311
-
:width:80%
312
-
:alt:Verify account.
313
-
314
-
4. Ensure the service name is accurate by selecting :strong:`Verify Service`.
315
-
316
-
* If you see the "Service name verified" message, proceed with :ref:`aws-privatelink-step3`.
317
-
318
-
* If you see the "Service name could not be verified" error message, your account ID is not yet allowed for the given service name. Reach out to Splunk Customer Support to check the status of your request from :ref:`aws-privatelink-step1`.
319
-
320
-
5. Select the subnet or subnets within the VPC where the endpoint will reside. Make sure to select the subnets from the appropriate availability zones.
321
-
322
-
6. Set the IP address type to ``IPv4``.
323
-
324
-
7. Specify the security group controlling traffic for the endpoint. Set the outbound rule to HTTPS protocol and the ``443`` port.
325
-
326
-
The following image shows the security options for AWS PrivateLink:
305
+
.. caution:: Under :guilabel:`Additional settings` do not select :guilabel:`Enable DNS name` at this point. Select this option after the VPC endpoint has been successfully created in :ref:`aws-privatelink-step4`.
:alt:Specify security groups that control traffic.
307
+
2. Under :guilabel:`Subnets` select the subnet(s) where the endpoint will reside.
331
308
332
-
8. Review the configuration details and select :guilabel:`Create Endpoint`.
309
+
3. Under :guilabel:`Security groups` select the security group(s) controlling traffic for the endpoint. Make sure to set the outbound rule to HTTPS protocol and the ``443`` port.
333
310
334
-
9. Before proceeding to :ref:`aws-privatelink-step4`, confirm with Splunk Customer Support that you created the endpoint, that the service name has been verified, and that Support has activated the endpoint urls.
311
+
4. Select :guilabel:`Create endpoint`.
335
312
336
313
.. _aws-privatelink-step4:
337
314
338
315
Step 4: Modify the endpoint to activate a Private DNS Name
If your monitored workloads in Splunk Observability Cloud are located in the AWS regions ``eu-central-1`` (eu1) or ``eu-west-2`` (eu2), or if you need to enable connectivity to the Splunk Observability Cloud accounts in those regions, use VPC peering instead of AWS PrivateLink since cross-region connectivity via AWS PrivateLink is not currently supported in these regions.
403
-
404
-
For the latest list of supported AWS regions for cross-region PrivateLink connectivity refer to the :new-page:`official AWS announcement <https://aws.amazon.com/about-aws/whats-new/2024/11/aws-privatelink-across-region-connectivity/>`.
405
-
406
-
Scenario: Connect your workloads to a Splunk Observability Cloud account in a different region
Examine a scenario where the workloads that you're monitoring with Splunk Observability Cloud are running in the AWS region ``eu-central-1``, and your Splunk Observability Cloud account is hosted in ``us-east-1``. You want to use AWS PrivateLink to ingest observability data, but AWS PrivateLink cross-region connectivity is not currently supported in these regions.
376
+
If the workloads that you're monitoring with Splunk Observability Cloud are not in the :ref:`aws-source-regions` list, follow the steps below:
410
377
411
-
Use VPC Peering instead with the following steps:
378
+
1. In your AWS account, either use an existing VPC or create a new VPC in one of Splunk Observability's AWS account regions mentioned in the :ref:`aws-privatelink-service-names`.
412
379
413
-
#. Ensure that you have a VPC set up in the destination region, in this example ``us-east-1``. If you don't have a VPC in that region, create a new one.
380
+
2. Set up AWS VPC peering between the regions where the workloads are being monitored and the region where the VPC used in step 1 is located.
414
381
415
-
#. Use AWS VPC peering to peer the ``eu-central-1`` and the ``us-east-1`` VPCs together in the source account with the workloads you want to monitor with Splunk Observability Cloud.
416
-
417
-
#. Activate AWS PrivateLink in the ``us-east-1`` VPC.
382
+
3. Follow :ref:`aws-privatelink-configure-vpc` to activate the AWS PrivateLink endpoint connection from the region where the VPC used in step 1 is located.
418
383
419
384
Learn more about VPC Peering in the AWS documentation at :new-page:`Two VPCs peered together <https://docs.aws.amazon.com/vpc/latest/peering/peering-configurations-full-access.html#two-vpcs-full-access>`.
420
385
421
-
.. Next steps
422
-
.. ================
423
-
424
-
.. After you connect Splunk Observability Cloud with AWS, you can use Splunk Observability Cloud to track a series of metrics and analyze your AWS data in real time.
425
-
426
-
.. - See the AWS official documentation for a list of the available AWS resources.
427
-
.. - See :ref:`how to leverage data from integration with AWS <aws-post-install>` for more information.
0 commit comments