Set Up AWS S3 Private Link

Alation Cloud Service Applies to Alation Cloud Service instances of Alation

Customer Managed Applies to customer-managed instances of Alation

Prerequisites

Important

From connector version 3.10.2 or newer, Alation supports private link connectivity for the same region. Therefore, ensure that the region in which Alation is hosted and the end user bucket is in the same region. For example, if the Alation instance is hosted in the us-east-1 region, you can establish the private link connectivity for buckets residing only in that region.

To configure private link for S3, perform the following configurations in Amazon S3 and Alation:

• Configure Private Link in Amazon S3

• Configure Private Link for S3 in Alation

Configure Private Link in Amazon S3

Contact Alation Support to configure a private link for the region in which your inventory and source buckets reside. Alation provisions interface endpoints to establish private connectivity between Alation Virtual Private Cloud and the end-user bucket.

Once the private link is configured, add either of the following permissions in the inventory and source buckets to establish a connection using the private link.

Note

• Update your existing policy to contain "Sid": "Access-to-specific-VPCE-only" and the rest of the policy should remain unchanged.

• The following Amazon S3 bucket policy allows access to a specific bucket from only the VPC endpoint vpce-1a2b3c4d: DOC-EXAMPLE-BUCKET2. The policy denies all access to the bucket if the specified endpoint is not in use. The aws:sourceVpce condition specifies the endpoint and doesn’t require an Amazon Resource Name (ARN) for the VPC endpoint resource, only the endpoint ID. To use this bucket policy, replace DOC-EXAMPLE-BUCKET2 and vpce-1a2b3c4d with your bucket name and endpoint.

• Before using the following example policy, replace the VPC endpoint ID with an appropriate value from your use case to access your bucket.

{
    "Version": "2012-10-17",
    "Id": "Policy1415115909152",
    "Statement": [
        {
        "Sid": "Access-to-specific-VPCE-only",
        "Principal": "*",
        "Action": [
            "s3:ListBucket",
            "s3:GetObject"
        ],
        "Effect": "Allow",
        "Resource": [
            "arn:aws:s3:::DOC-EXAMPLE-BUCKET2",
            "arn:aws:s3:::DOC-EXAMPLE-BUCKET2/*"
        ],
        "Condition": {
            "StringEquals": {
            "aws:sourceVpce": "vpce-1a2b3c4d"
            }
        }
        }
    ]
}

Note

• This policy restricts console access to the specified bucket, as console requests don’t originate from the specified VPC endpoint.

{
    "Version": "2012-10-17",
    "Id": "Policy1415115909152",
    "Statement": [
        {
        "Sid": "Access-to-specific-VPCE-only",
        "Principal": "*",
        "Action": [
            "s3:ListBucket",
            "s3:GetObject"
        ],
        "Effect": "Deny",
        "Resource": [
            "arn:aws:s3:::DOC-EXAMPLE-BUCKET2",
            "arn:aws:s3:::DOC-EXAMPLE-BUCKET2/*"
        ],
        "Condition": {
            "StringNotEquals": {
            "aws:sourceVpce": "vpce-1a2b3c4d"
            }
        }
        }
    ]
}

Configure Private Link for S3 in Alation

Go to the General Settings tab of your Amazon S3 file system source and provide the private link provided by the Alation team in the Private Link field under the Configure Authentication section. Format to be used - https://bucket.<vpc-endpoint-id>.s3.<region>.vpce.amazonaws.com. Example - https://bucket.vpce1a2b3c4d-xyz.s3.us-east-1.vpce.amazonaws.com