Skip to content

Commit fe60152

Browse files
jmmargojmmargo
authored
Merge pull request #20457 from Madeline-Schaefer/master
Automatic commit: Move 'private-link-aws' from QA to Production
2 parents 0446e33 + 139752b commit fe60152

8 files changed

Lines changed: 203 additions & 0 deletions

‎tutorials/private-link-aws/2022-08-03_13-49-09.png‎

223 KB
Loading

‎tutorials/private-link-aws/2022-08-03_13-51-21.png‎

208 KB
Loading

‎tutorials/private-link-aws/2022-08-03_13-51-47.png‎

539 KB
Loading

‎tutorials/private-link-aws/AWS-Endpoint-Service.png‎

333 KB
Loading

‎tutorials/private-link-aws/Accept-endpoint-connection.png‎

208 KB
Loading

‎tutorials/private-link-aws/Service-name-from-details.png‎

229 KB
Loading

‎tutorials/private-link-aws/private-endpoint.png‎

21.9 KB
Loading

‎tutorials/private-link-aws/private-link-aws.md‎

Lines changed: 203 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
---
2+
parser: v2
3+
author_name: Madeline Schaefer
4+
author_profile: https://github.com/Madeline-Schaefer
5+
auto_validation: true
6+
time: 20
7+
tags: [ tutorial>beginner, software-product-function>sap-btp-cockpit, software-product>sap-business-technology-platform, tutorial>license, software-product-function>sap-btp-command-line-interface, software-product-function>sap-private-link-Service]
8+
primary_tag: software-product-function>sap-btp-cockpit
9+
---
10+
11+
# Connect SAP Private Link Service to AWS Private Link Service
12+
<!-- description --> Connect SAP Private Link service to AWS Private Link Service with Cloud Foundry CLI and bind the service instance to your app or create a service key.
13+
14+
## Prerequisites
15+
- You have a global account and subaccount on SAP Business Technology Platform with SAP Private Link service entitlement: [Set Up SAP Private Link Service](developers-qa-blue.wcms-nonprod.c.eu-de-2.cloud.sap/tutorials/private-link-onboarding).
16+
- You have created an AWS Private Link Service in the Amazon VPC Console. [Create a service powered by AWS Private Link](https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html).
17+
- You have installed Cloud Foundry CLI. See [Install the Cloud Foundry Command Line Interface (CLI)](developers.sap.com/tutorials/cp-cf-download-cli).
18+
19+
## You will learn
20+
- How to create an SAP Private Link service instance to connect to your AWS Private Link Service using Cloud Foundry CLI.
21+
- How to bind the service instance to your application using Cloud Foundry CLI.
22+
23+
## Intro
24+
SAP Private Link service establishes a private connection between applications running on SAP BTP and selected services in your own IaaS provider accounts. By reusing the private link functionality of our partner IaaS providers, you can access your services through private network connections to avoid data transfer via the public internet.
25+
26+
<!-- border -->![Overview of Link service functionality](private-endpoint.png)
27+
28+
---
29+
30+
### Check offerings of Private Link Service
31+
32+
33+
After you've logged in to the BTP Cloud Foundry region as described in [Install the Cloud Foundry Command Line Interface (CLI)](developers.sap.com/tutorials/cp-cf-download-cli.), please access the **Service Marketplace** of SAP BTP. To do this, open a command prompt on your computer and type in the following:
34+
35+
``Shell/Bash
36+
cf marketplace
37+
``
38+
39+
```Shell/Bash
40+
cf Marketplace
41+
Getting all service offerings from marketplace in org... / xy... trial as admin...
42+
43+
offering plans description
44+
privatelink standard Link service establishes a private connection between selected SAP BTP services and selected services in your own IaaS provider accounts.
45+
```
46+
47+
Make sure you can see `privatelink` in the sample output.
48+
49+
50+
### Get service name for AWS Endpoint Service
51+
52+
53+
To create and enable a private link, you need to define the connection to the service first. To do so, you need the service name of the endpoint service that you created as part of the prerequisites:
54+
55+
1. Go to the VPC console.
56+
<!-- border -->![AWS Endpoint Service](AWS-Endpoint-Service.png)
57+
58+
2. Navigate to the **Endpoint Services**.
59+
3. Search for the endpoint service you want to connect, select it and copy the Service name from the **Details** tab. You need it in the next step.
60+
61+
<!-- border -->![Service Name](Service-name-from-details.png)
62+
63+
64+
65+
66+
### Create private link service
67+
68+
69+
Currently, you do not have any service instances enabled. Therefore, you need to create one. To create a new private link, you need the following information:
70+
71+
- service offering (`private link`),
72+
- service plan (`standard`),
73+
- a unique name (for instance, `privatelink-test`),
74+
- service name from AWS (for example, `com.amazonaws.vpce.us-east-1.<service-id>`).
75+
76+
Enter `cf create-service` and add that information. Your command should look like this:
77+
78+
```Shell/Bash
79+
cf create-service privatelink standard privatelink-test -c '{"serviceName":"ServiceName"}'
80+
```
81+
82+
> **Example**:
83+
`cf create-service privatelink standard privatelink-test -c '{"serviceName": "com.amazonaws.vpce.us-east-1.<service-id>"}'
84+
`
85+
86+
If the creation of the service instance was accepted, you receive a success message telling you to proceed.
87+
88+
89+
90+
91+
### Check status of private link
92+
93+
94+
To check the current status of the newly created service instance, you need the name of your service instance (in this example `privatelink-test`). Type in the following:
95+
96+
```Shell/Bash
97+
cf service privatelink-test
98+
```
99+
100+
Under "message", you can see the current status. Please renew the command after approximately one minute. You should see the following message:
101+
102+
```Shell/Bash
103+
Showing status of last operation:
104+
105+
status: create in progress
106+
message: Connection from VPC Endpoint ID 'vpce-047f057f38a2e27e1' not yet approved at VPC Endpoint Service 'com.amazonaws.vpc.us-east-1.vpce-svc-0d727708b69ad6738'. Waiting for approval.
107+
```
108+
109+
> Execute this command again, if there's no change in the current status. If you receive an error message, go back to the previous steps.
110+
111+
Copy the VPC Endpoint ID from the success message. You need it in the next step.
112+
113+
> **Security Info**: In a scenario in which the initiator of the private link connection doesn't have access to the VPC Console to approve the new private endpoint connection him- or herself, please reach out to the person responsible for approving the connection on your side and share the endpoint ID responsibly.
114+
115+
116+
117+
### Approve connection in AWS
118+
119+
120+
Return to the VPC console:
121+
122+
1. Navigate to the **Endpoint Services**.
123+
2. Select the endpoint service you want to connect to.
124+
3. Go to **Endpoint Connections**.
125+
4. Search for the endpoint ID and select the connection request.
126+
5. Accept the endpoint connection request by pressing on **Actions > Accept endpoint connection request**.
127+
128+
<!-- border -->![Accept endpoint connection](Accept-endpoint-connection.png)
129+
130+
131+
You should now receive a success message that the approval is pending.
132+
133+
>**Security Info**: In a scenario in which the person that approves the endpoint connection wasn't the one that created the Private Link service in the first place, please verify that the connection originated from a trustworthy origin (for instance, a colleague asking for approval via e-mail). This verification process prevents malicious misuse of resource ids. See also <link to AWS Doku?>
134+
135+
136+
137+
138+
### Check status of private link
139+
140+
To check the current status of the newly created service instance, you need the name of your service instance (in this example `privatelink-test`). Type in the following:
141+
142+
```Shell/Bash
143+
cf service privatelink-test
144+
```
145+
146+
You should see the following success message:
147+
148+
```Shell/Bash
149+
status: create succeeded
150+
151+
message: Connection from VPC Endpoint ID 'vpce-047f057f38a2e27e1' to VPC Endpoint Service 'com.amazonaws.vpce.us-east-1.vpce-svc-0d727708b69ad6738' is established.
152+
started: <date>
153+
updated: <date>
154+
```
155+
156+
157+
158+
### Bind application to service instance
159+
160+
161+
Upon the creation of a binding between a CF application and a private link service instance, Private Link service creates a space-scoped [Cloud Foundry application security group](https://docs.cloudfoundry.org/concepts/asg.html) hat enables network access to the IP address associated with the private endpoint.
162+
163+
To bind the service instance to your application, You need to know the name of your application and your service instance (in this example `privatelink-test`). Then, execute the following command:
164+
165+
```Shell/Bash
166+
cf bind-service "appname" "privatelink-test"
167+
```
168+
For more information, see [Binding Credentials](https://help.sap.com/docs/PRIVATE_LINK/d5fcaf2c5262485a87c6143b61b2c76b/6d1453baa5fa4e8fb3297e53ceb96bf6.html?locale=en-US&state=DRAFT#binding-credentials).
169+
170+
>If you do not have an app that you'd like to bind to your service instance, you can create a service key by running cf create-service-key<service-instance-name> <key-name>. After the creation of your service binding, your application receives the information on how to connect via the binding credentials. See the following example for binding credentials:
171+
172+
> ```JSON
173+
{
174+
"privatelink": [
175+
{
176+
"binding_guid": "0bfa43f4-39b7-4c7d-b0d3-d55eec0f0597",
177+
"binding name": "null,
178+
"credentials": {
179+
"hostname": "<private-link hostname>"
180+
},
181+
"instance_guid": "b506c523-3758-4ba6-bea6-f93418c82795",
182+
"instance_name": "privatelink-test"
183+
"label": "privatelink",
184+
"name": "privatelink-test",
185+
"plan": "standard",
186+
"provider": null,
187+
"syslog_drain_url": null,
188+
"tags": [
189+
"privatelink",
190+
"privatelinkservice"
191+
],
192+
"volume_mounts": []
193+
}
194+
]
195+
}
196+
```
197+
198+
199+
---
200+
201+
Congratulations! You have successfully completed the tutorial.
202+
203+
---

0 commit comments

Comments
 (0)