AWS PrivateLink

Overview

This guide walks you through setting up AWS PrivateLink to establish a private connection between your AWS VPC and Dash0's ingestion endpoints. With PrivateLink, your telemetry data travels through Amazon's private network backbone without traversing the public internet.

This guide focuses on same-region connectivity, where your workloads and the Dash0 ingestion endpoint are in the same AWS region.

Prerequisites

Before setting up AWS PrivateLink for Dash0, ensure:

• You have an active Dash0 account with access to your authentication token
• You have appropriate AWS IAM permissions to create VPC endpoints
• Your VPC has DNS resolution and DNS hostnames enabled
• You have identified the AWS region where your workloads are running

Supported Regions

Dash0 currently supports AWS PrivateLink connections in the following regions:

Region	Endpoint Service Name
eu-west-1	com.amazonaws.vpce.eu-west-1.vpce-svc-0046745eec6c61a3f
us-west-2	com.amazonaws.vpce.us-west-2.vpce-svc-024e2cd84acbadbc0

After creating the VPC endpoint, you'll use the according private DNS name as the endpoint in your OpenTelemetry Collector configuration.

Create VPC Endpoint

Using AWS Console

1. Navigate to the VPC service in the AWS Console
2. In the left sidebar, select Endpoints
3. Click Create endpoint
4. Configure the endpoint:
   • Name tag: Enter a descriptive name (e.g., dash0-privatelink)
   • Type category: Select PrivateLink Ready partner services
   • Service name: Enter the Dash0 service name for your region from the table above
   • Click Verify service to validate the service name
5. Select your VPC from the dropdown
6. Under Additional settings:
   • Enable DNS name: Check this box to enable private DNS for the endpoint
   • Enable Cross Region endpoint: Check this box if your services are running in a different AWS region
7. Select the subnets where you want to create endpoint network interfaces (typically where your workloads run)
8. Configure Security groups:
   • The security group is attached to the VPC endpoint's network interface (ENI), not your workloads. From the endpoint's perspective, traffic from your workloads arrives as inbound traffic. Configure inbound rules to allow traffic on port 4317 (gRPC), 4318 (HTTP), and 443 (HTTPS) from your workloads' security group or CIDR range.
9. Review your configuration and click Create endpoint

DNS Configuration

When you enable private DNS for your VPC endpoint, AWS automatically creates DNS records that resolve the Dash0 endpoint hostname to the private IP addresses of your VPC endpoint network interfaces.

Verify DNS Resolution

After creating the VPC endpoint, verify that DNS resolution is working correctly:

Requirements

For private DNS to work correctly, ensure your VPC has:

• DNS resolution: Enabled (default)
• DNS hostnames: Enabled

You can verify and enable these settings:

Configure OpenTelemetry Collector

Once your VPC endpoint is created and DNS is configured, update your OpenTelemetry Collector configuration to use the PrivateLink endpoint:

If you're using the Dash0 Operator for Kubernetes, update the operator configuration:

Verification

After configuring your OpenTelemetry Collector or Dash0 Operator, verify the connection:

1. Check VPC Endpoint Status: In the AWS Console, navigate to VPC > Endpoints and verify your endpoint shows status Available
2. Monitor VPC Endpoint Metrics: Check the Monitoring tab of your VPC endpoint for metrics like:
   • Active connections
   • Bytes sent/received
   • Packet counts
3. Check Collector Logs: Review your OpenTelemetry Collector logs for successful connections:
4. Verify Data in Dash0: Navigate to your Dash0 dashboard and confirm that traces, metrics, and logs are being received