AWS PrivateLink

Overview

This topic explains how to configure and use the PrivateLink integration for LaunchDarkly.

The PrivateLink integration lets you configure AWS PrivateLink to route your event egress traffic through the AWS network backbone. Sending event egress traffic through PrivateLink can significantly reduce NAT Gateway and internet data transfer costs. Additionally, it lets you enforce stricter egress firewalls because none of the traffic to LaunchDarkly will traverse the public internet.

Only event egress traffic is supported for PrivateLink. This traffic is generated by LaunchDarkly SDKs to track various behaviors, such as which contexts have received which variant of a feature flag. PrivateLink is most useful for customers using LaunchDarkly for experimentation or guarded rollouts because these products can generate significant amounts of event egress traffic. If you want to limit ingress traffic for flags, consider using the Relay Proxy.

Prerequisites

Before you can configure PrivateLink, you must add your AWS account to our allowlist. Contact your LaunchDarkly account manager or our Support team to get started.

Configuring endpoints in different AWS regions

By default, the LaunchDarkly PrivateLink service runs in the us-east-1 region. AWS supports cross-region PrivateLink connectivity, which lets you create endpoints in other regions that connect to this service.

You can create PrivateLink endpoints in any of the following AWS regions:

When creating an endpoint outside of us-east-1, do the following:

1. In the AWS Console, check the Enable Cross Region endpoint box under Service Region.
2. Set the service region to us-east-1.
3. Click Verify service after selecting these options.

When using the AWS CLI, include the --service-region us-east-1 argument when creating endpoints outside of us-east-1. Do not include this argument when creating endpoints in us-east-1.

For example:

$
aws ec2 create-vpc-endpoint \
>
  --vpc-id vpc-0123456789abcdef0 \
>
  --vpc-endpoint-type Interface \
>
  --service-name com.amazonaws.vpce.us-east-1.vpce-svc-02ce0367b7e976a75 \
>
  --service-region us-east-1 \
>
  --subnet-ids subnet-11111111 subnet-22222222 \
>
  --security-group-ids sg-12345678

Configure the LaunchDarkly integration in the AWS Console

To configure the integration in the AWS Console:

1. Go to the AWS VPC Console in the us-east-1 region. If you are configuring an endpoint in another region, follow the steps in Configuring endpoints in different AWS regions.
2. Click Endpoints in the left navigation pane.
3. Click the Create Endpoint button in the top right. The Create Endpoint page appears.
4. Enter your endpoint name, select PrivateLink Ready partner services as the category, enter com.amazonaws.vpce.us-east-1.vpce-svc-02ce0367b7e976a75 as the service name, and click Verify Service.

5. Select the VPC to connect to the endpoint from.
6. Select Enable DNS Name in Additional Settings. This enables events.launchdarkly.com to resolve to this endpoint from within this VPC.

7. Select subnets to use for the Availability Zones that you would like the endpoint to exist in.
8. Select or create a Security Group that allows inbound access on port 443 from the VPC.
9. Click Create Endpoint. The endpoint enters a Pending state. When the endpoint has been provisioned and becomes Available, traffic will begin to route through it.