AWS PrivateLink

Overview

AWS PrivateLink provides private connectivity between your VPC and Dash0's ingestion endpoints, ensuring that your telemetry data never traverses the public internet. By establishing a VPC endpoint connection, you can send traces, metrics, and logs to Dash0 through Amazon's private network backbone, enhancing security and reducing exposure to internet-based threats.

This integration enables you to maintain compliance with data security policies while benefiting from Dash0's observability platform. Traffic flows directly from your AWS resources to Dash0's service endpoints through a secure, private connection managed entirely within the AWS network infrastructure.

Use Cases

• Securely send telemetry data to Dash0 without exposing traffic to the public internet
• Maintain compliance with strict data security and privacy requirements
• Reduce network egress costs by keeping traffic within the AWS network
• Establish private connectivity for AWS workloads in isolated VPCs

Overview

This guide walks you through setting up AWS PrivateLink to establish a private connection between your AWS VPC and Dash0's ingestion endpoints. With PrivateLink, your telemetry data travels through Amazon's private network backbone without traversing the public internet.

This guide focuses on same-region connectivity, where your workloads and the Dash0 ingestion endpoint are in the same AWS region.

Prerequisites

Before setting up AWS PrivateLink for Dash0, ensure:

• You have an active Dash0 account with access to your authentication token
• You have appropriate AWS IAM permissions to create VPC endpoints
• Your VPC has DNS resolution and DNS hostnames enabled
• You have identified the AWS region where your workloads are running

Supported Regions

Dash0 currently supports AWS PrivateLink connections in the following regions:

After creating the VPC endpoint, you'll use the according private DNS name as the endpoint in your OpenTelemetry Collector configuration.

The ingress host is the ingestion endpoint, {{endpoint_privatelink_otlp_grpc_hostname}}. The endpoint service also carries the api and decision-maker hosts, which use the same hostname with the leading ingress. replaced by api. and decision-maker.. With them, SignalControl Edge works over the same VPC endpoint.

Endpoints created before October 2026 use an ingestion-only service, which keeps working. See Migrate an Existing Endpoint to add the api and decision-maker hosts.

Create VPC Endpoint

Using AWS Console

1. Navigate to the VPC service in the AWS Console
2. In the left sidebar, select Endpoints
3. Click Create endpoint
4. Configure the endpoint:
   • Name tag: Enter a descriptive name (e.g., dash0-privatelink)
   • Type category: Select PrivateLink Ready partner services
   • Service name: Enter the Dash0 service name for your region from the table above
   • Click Verify service to validate the service name
5. Select your VPC from the dropdown
6. Under Additional settings:
   • Enable DNS name: Check this box to enable private DNS for the endpoint
   • Enable Cross Region endpoint: Check this box if your services are running in a different AWS region
7. Select the subnets where you want to create endpoint network interfaces (typically where your workloads run)
   • For a same-region endpoint, select a subnet in every Availability Zone the console offers. An endpoint pinned to a single zone only works if that zone is one that currently serves traffic, and a mismatch shows up as connection timeouts with no error reported on either side. If you need to pin the endpoint to one zone to limit costs, ask Dash0 support which Availability Zone to use
   • Cross-region endpoints are not subject to this constraint
8. Configure Security groups:
   • The security group is attached to the VPC endpoint's network interface (ENI), not your workloads. From the endpoint's perspective, traffic from your workloads arrives as inbound traffic. Configure inbound rules to allow traffic on port 4317 (gRPC), 4318 (HTTP), and 443 (HTTPS) from your workloads' security group or CIDR range.
9. Review your configuration and click Create endpoint

DNS Configuration

When you enable private DNS for your VPC endpoint, AWS automatically creates DNS records that resolve the Dash0 endpoint hostname to the private IP addresses of your VPC endpoint network interfaces.

Verify DNS Resolution

After creating the VPC endpoint, verify that DNS resolution is working correctly:

# From an EC2 instance or container within your VPC
nslookup {{endpoint_privatelink_otlp_grpc_hostname}}

# You should see private IP address
# indicating traffic will route through your VPC endpoint

Requirements

For private DNS to work correctly, ensure your VPC has:

• DNS resolution: Enabled (default)
• DNS hostnames: Enabled

You can verify and enable these settings:

# Check DNS settings
aws ec2 describe-vpc-attribute --vpc-id $VPC_ID --attribute enableDnsSupport
aws ec2 describe-vpc-attribute --vpc-id $VPC_ID --attribute enableDnsHostnames

# Enable if needed
aws ec2 modify-vpc-attribute --vpc-id $VPC_ID --enable-dns-support
aws ec2 modify-vpc-attribute --vpc-id $VPC_ID --enable-dns-hostnames

Configure OpenTelemetry Collector

Once your VPC endpoint is created and DNS is configured, update your OpenTelemetry Collector configuration to use the PrivateLink endpoint:

exporters:
  otlp:
    endpoint: "{{endpoint_privatelink_otlp_grpc_hostname}}:{{endpoint_privatelink_otlp_grpc_port}}"
    headers:
      authorization: "Bearer {{token}}"
    tls:
      insecure: false
    # Adding keepalive to the OTEL gRPC exporter can improve connection reliability from idle connection timeout.
    # The settings are a reference; tune them to your environment.
    keepalive:
      time: 120s
      timeout: 30s
      permit_without_stream: true

service:
  pipelines:
    traces:
      exporters: [otlp]
    metrics:
      exporters: [otlp]
    logs:
      exporters: [otlp]

If you're using the Dash0 Operator for Kubernetes, update the operator configuration:

apiVersion: operator.dash0.com/v1alpha1
kind: Dash0
metadata:
  name: dash0-operator-configuration
spec:
  export:
    dash0:
      endpoint: "{{endpoint_privatelink_otlp_grpc_hostname}}:{{endpoint_privatelink_otlp_grpc_port}}"
      authorization:
        token:
          secretRef:
            name: dash0-authorization-token
            key: token

SignalControl Edge

SignalControl Edge needs two Dash0 hosts besides ingestion: api, which serves its settings, and decision-maker, which serves tail-sampling decisions over gRPC. Both are reachable through the PrivateLink endpoint on port 443, the same port as ingestion, so the endpoint security group needs no extra rule.

Point Edge at the PrivateLink hostnames instead of the public ones. Derive them from {{endpoint_privatelink_otlp_grpc_hostname}} by replacing the leading ingress.:

Use the same authorization token as for ingestion.

Migrate an Existing Endpoint

An endpoint to one of the ingestion-only services below resolves only the ingress host. To also reach the api and decision-maker hosts, move to the service listed in Supported Regions:

The move needs no interruption:

1. Create a second VPC endpoint to the service from Supported Regions with Enable DNS name checked, as described in Create VPC Endpoint. Both endpoints can have private DNS enabled in the same VPC.
2. While both endpoints exist, the ingress host keeps resolving to the existing endpoint, and the api and decision-maker hosts resolve to the new one. Ingestion continues unchanged.
3. Delete the existing endpoint when convenient. The ingress host then resolves to the new endpoint. Collector configuration does not change, since the hostnames stay the same.

Verification

After configuring your OpenTelemetry Collector or Dash0 Operator, verify the connection:

1. Check VPC Endpoint Status: In the AWS Console, navigate to VPC > Endpoints and verify your endpoint shows status Available
2. Monitor VPC Endpoint Metrics: Check the Monitoring tab of your VPC endpoint for metrics like:
   • Active connections
   • Bytes sent/received
   • Packet counts
3. Check Collector Logs: Review your OpenTelemetry Collector logs for successful connections:
   bash

   # Look for successful OTLP exports
   kubectl logs -n dash0-system deployment/dash0-operator-controller

4. Verify Data in Dash0: Navigate to your Dash0 dashboard and confirm that traces, metrics, and logs are being received