Skip to content

Connecting to PlanetScale privately on AWS

How to connect to PlanetScale privately on AWS via PrivateLink.

When your compliance mandates that your connections do not route through the public Internet, PlanetScale provides private connection endpoints to AWS regions via AWS PrivateLink. Private connections are included on Scaler Pro plans. There is no additional charge on PlanetScale's end, but this may impact your AWS bill.

Below is a list of instructions to set up your Virtual Private Cloud (VPC) to utilize a VPC endpoint when communicating with PlanetScale databases.

Establishing a VPC endpoint

  1. Identify the AWS region that your VPC lives in, which we will refer to as <aws-region> for the rest of this document.

  2. Navigate to the "Endpoints" section on the VPC page and select "Create Endpoint."

  1. Select "Other endpoint services" and fill the Service Name text box according to which region you want to establish AWS PrivateLink for:

AWS Region NameAWS RegionVPC Endpoint Service Name
US East (Ohio)
US East (N. Virginia)
US West (Oregon)
Asia Pacific (Mumbai)ap-south-1com.amazonaws.vpce.ap-south-1.vpce-svc-06556ed2371c5fdd2
Asia Pacific (Singapore)ap-southeast-1com.amazonaws.vpce.ap-southeast-1.vpce-svc-046d8feae38660302
Asia Pacific (Sydney)ap-southeast-2com.amazonaws.vpce.ap-southeast-2.vpce-svc-03e5578eeaf446c90
Asia Pacific (Tokyo)ap-northeast-1com.amazonaws.vpce.ap-northeast-1.vpce-svc-099c246fa320e54d1
Europe (Frankfurt)
Europe (Ireland)
Europe (London)
South America (São Paulo)
  1. Once you have filled in the Service Name text box, click "Verify service".

  1. Choose the VPC and subnets that should be peered with the PlanetScale service endpoint.

  2. Click the "Additional settings" dropdown arrow to reveal the "DNS name" configuration, and select the "Enable DNS name" checkbox.

  1. Choose the security group of your choice to control what can send traffic to the PlanetScale service endpoint.

  2. Click "Create endpoint" and verify that the VPC endpoint's status reports "Available" after a few minutes.

Verifying the connectivity of your VPC endpoint

  1. In the AWS UI, confirm that the endpoint has successfully been created by verifying that the Status section of the endpoint reads "Available".

Some PlanetScale regions are named differently than AWS Provider regions. We will refer to the PlanetScale region as <planetscale-region> for the rest of this document.

  1. Confirm that the Private DNS Names reads: <planetscale-region> In the below example, we have configured our own VPC endpoint for us-east.

  1. Log into any EC2 instance in the configured VPC and run dig +short <planetscale-region> to confirm that DNS resolution is producing IP Addresses in the range of your VPC's CIDR.
dig +short
  1. Run curl https://<planetscale-region> to verify your connectivity. A successful response will yield Welcome to PlanetScale.
Welcome to PlanetScale.

Modifying your Connection Strings to utilize your VPC endpoint.

By default, PlanetScale provides users with a connection string that reads <planetscale-region>

To utilize your newly configured VPC endpoint, prepend private- to the connect subdomain as shown above, yielding a connection string that reads <planetscale-region>

Need help?

Get help from the PlanetScale support team, or join our GitHub discussion board to see how others are using PlanetScale.

Was this page useful?
Last updated on Help us improve this page