Connect SAP Private Link Service to AWS Private Link Service

After you’ve logged in to the BTP Cloud Foundry region as described in Install the Cloud Foundry Command Line Interface (CLI), please access the Service Marketplace of SAP BTP. To do this, open a command prompt on your computer and type in the following:

Shell/Bash cf marketplace

 cf Marketplace
  Getting all service offerings from marketplace in org... / xy... trial as admin...

  offering       plans       description
  privatelink    beta    Link service establishes a private connection between selected SAP BTP services and selected services in your own IaaS provider accounts.

Make sure you can see privatelink in the sample output.

To create and enable a private link, you need to define the connection to the service first. To do so, you need the service name of the endpoint service that you created as part of the prerequisites:

1. Go to the AWS VPC console.
   

   

2. Navigate to the Endpoint Services.

3. Search for the endpoint service you want to connect, select it and copy the Service name from the Details tab. You need it in the next step.

Currently, you do not have any service instances enabled. Therefore, you need to create one. To create a new private link, you need the following information:

• service offering (private link),
• service plan (beta),
• a unique name (for instance, privatelink-test),
• service name from AWS (for example, com.amazonaws.vpce.us-east-1.<service-id>).

Enter cf create-service and add that information. Your command should look like this:

cf create-service privatelink beta privatelink-test -c '{"serviceName":"ServiceName"}'

Example:
cf create-service privatelink beta privatelink-test -c '{"serviceName": "com.amazonaws.vpce.us-east-1.<service-id>"}'

If the creation of the service instance was accepted, you receive a success message telling you to proceed.

To check the current status of the newly created service instance, you need the name of your service instance (in this example privatelink-test). Type in the following:

cf service privatelink-test

Under “message”, you can see the current status. Please renew the command after approximately one minute. You should see the following message:

Showing status of last operation:

status:     create in progress
message:    Connection from VPC Endpoint ID 'vpce-047f057f38a2e27e1' not yet approved to service 'com.amazonaws.vpc.us-east-1.vpce-svc-0d727708b69ad6738'. Waiting for approval.

Execute this command again, if there’s no change in the current status. If you receive an error message, go back to the previous steps.

Copy the VPC Endpoint ID from the success message. You need it in the next step.

Security Info: In a scenario in which the initiator of the private link connection doesn’t have access to the VPC Console to approve the new private endpoint connection themselves, please reach out to the person responsible for approving the connection on your side and share the endpoint ID responsibly.

Return to the AWS VPC console:

1. Navigate to the Endpoint Services.
2. Select the endpoint service you want to connect to.
3. Go to Endpoint Connections.
4. Search for the endpoint ID and select the connection request.
5. Accept the endpoint connection request by pressing on Actions > Accept endpoint connection request.

You should now receive a success message that the approval is pending.

Security Info: In a scenario in which the person that approves the endpoint connection wasn’t the one that created the Private Link Service in the first place, please verify that the connection originated from a trustworthy origin (for instance, a colleague asking for approval via e-mail). This verification process prevents malicious misuse of resource ids.

To check the current status of the newly created service instance, you need the name of your service instance (in this example privatelink-test). Type in the following:

  cf service privatelink-test

You should see the following success message:

  status:     create succeeded

  message:    Connection from VPC Endpoint ID 'vpce-047f057f38a2e27e1' to service 'com.amazonaws.vpce.us-east-1.vpce-svc-0d727708b69ad6738' is established.
  started:    <date>
  updated:    <date>

Upon the creation of a binding between a CF application and an SAP Private Link Service instance, SAP Private Link Service creates a space-scoped Cloud Foundry application security group that enables network access to the IP address associated with the private endpoint.

To bind the service instance to your application, you need to know the name of your application and your service instance (in this example privatelink-test). Then, execute the following command:

cf bind-service "<appname>" "privatelink-test"

For more information, see Binding Credentials.

If you do not have an app that you’d like to bind to your service instance, you can create a service key by running cf create-service-key .

After the creation of your service binding, your application receives the information on how to connect via the binding credentials. See the following example for binding credentials:

JSON

Copy

{
    "privatelink": [
        {
            "binding_guid": "0bfa43f4-39b7-4c7d-b0d3-d55eec0f0597",
            "binding name": "null,
            "credentials": {
                "hostname": "<private-link hostname>"
            },
            "instance_guid": "b506c523-3758-4ba6-bea6-f93418c82795",
            "instance_name": "privatelink-test"
            "label": "privatelink",
            "name": "privatelink-test",
            "plan": "beta",
            "provider": null,
            "syslog_drain_url": null,
            "tags": [
              "privatelink",
              "privatelinkservice"
            ],
            "volume_mounts": []
          }
      ]
}

Congratulations! You have successfully completed the tutorial.