Skip to main content
AWS PrivateLink keeps traffic between your VPC and Neki on the AWS network without traversing the public internet. Use it when your compliance requirements or network architecture require private database connectivity. Standard Neki connections use TLS over the public internet and are appropriate for most applications. PrivateLink adds network isolation; Neki still requires TLS for connections through the private endpoint.

​
Pricing

PlanetScale bills PrivateLink ingress and egress at $0.01 per GB after the branch’s included allowance. AWS also charges for VPC endpoints and data processing. See Neki pricing and the AWS PrivateLink pricing page.

​
Prerequisites

  • A Neki database in an AWS region.
  • An AWS VPC in the same region as the Neki database.
  • IAM permissions to create VPC endpoints and manage their security groups.
  • A host in the VPC from which you can test DNS and Postgres connectivity.

​
Get the private connection details

1
From the PlanetScale dashboard, select your Neki database.
2
Open Settings, then select Roles.
3
Select the branch and open the role your application uses.
4
Select the required router group under Connection target.
5
Copy the Private Host and Private Service Name.
The private host and service name identify the Neki service. The role’s generated username still identifies the branch and selected router group. Copy the complete username from the dashboard instead of constructing it. Use the service name shown for each role and connection target. Do not assume that every Neki service in an AWS region has the same service name. An existing VPC endpoint can be reused only when the dashboard shows the same Private Service Name for the new connection.

​
Create the VPC endpoint

1
Create a security group for the endpoint that allows inbound TCP traffic on port 5432 from your application resources. Referencing the applications’ security group is more restrictive than allowing the entire VPC CIDR.
2
In the AWS console, open VPC > Endpoints and select Create endpoint.
3
For the endpoint type, select Endpoint services that use NLBs and GWLBs.
4
Enter the Private Service Name from PlanetScale and select Verify service.
5
Select the VPC and the subnets your application can reach. Select at least two subnets for availability.
6
Under Additional settings, enable the DNS name.
7
Attach the endpoint security group and create the endpoint.
8
Wait until the endpoint status is Available.
Your application resources must also allow outbound TCP traffic on port 5432. If the selected subnets use restrictive network ACLs, allow port 5432 and the ephemeral ports required for response traffic.

​
Verify the endpoint

From a host in the configured VPC, confirm that the Private Host resolves to private addresses:
Then connect using the private host and the username and password for your role:
Update application connection strings by replacing the public host with the private host. Keep the generated username, port, database, TLS settings, and password unchanged.

​
Troubleshooting

If the connection fails:
  1. Confirm that the VPC endpoint status is Available.
  2. Confirm that the endpoint is in the same AWS region as the Neki database.
  3. Check inbound rules on the endpoint security group and outbound rules on the application security group.
  4. Check the network ACLs for the endpoint and application subnets.
  5. Verify that the private host resolves to addresses in the VPC.
  6. Use AWS Reachability Analyzer to inspect the path between the application and endpoint.

​
Need help?

Get help from the PlanetScale Support team, or join our Discord community to see how others are using PlanetScale.