Skip to main content
AWS PrivateLink lets you reach your Xata databases from your own AWS VPC over the AWS private network. Traffic never traverses the public internet, and your connection strings stay exactly the same. PrivateLink is available on request. Please contact us via our regular support channels and provide us with:
  • The AWS region of your Xata databases (e.g. us-east-1)
  • The AWS account ID (or IAM role/user ARN) you will create the endpoint from.
In return we will provide you with the service name of the Xata VPC endpoint service to connect to. It will be in the form com.amazonaws.vpce.us-east-1.vpce-svc-....

​
How it works

Xata exposes its Postgres gateway as a VPC endpoint service. You create an interface VPC endpoint against it in your VPC, which places network interfaces (ENIs) with private IPs in your subnets. With private DNS enabled, your existing database hostnames (<branch>.us-east-1.xata.tech) resolve to those private IPs inside your VPC. This means the same connection string uses the private path from your VPC and the public path from everywhere else.

​
Prerequisites

  • A VPC in the same region and Availability Zone (AZ) as your Xata databases.
  • The VPC must have DNS support and DNS hostnames enabled (enableDnsSupport and enableDnsHostnames, both on by default for most VPCs).

​
Step 1 — Create a security group for the endpoint

The endpoint’s network interfaces need a security group that allows inbound traffic from your clients:
  • TCP 5432 (Postgres wire protocol) from your application’s security group or CIDR ranges
  • TCP 443 (HTTPS) from the same sources — only needed if you use the serverless HTTP driver

​
Step 2 — Create the interface VPC endpoint

In the AWS console, go to VPC → PrivateLink and Lattice → Endpoints and click Create endpoint:
  1. Optionally give the endpoint a Name tag (e.g. xata).
  2. Under Type, select Endpoint services that use NLBs and GWLBs (“Find services shared with you by service name”).
  3. Leave Enable Cross Region endpoint unchecked. Your endpoint must be in the same region as your Xata databases.
  4. In the Service name field, paste the service name provided by Xata (com.amazonaws.vpce.us-east-1.vpce-svc-…) and click Verify service. If this fails with a permissions error, please contact us.
  5. The form expands: select your VPC and one subnet per Availability Zone you want to use.
  6. Attach the security group from step 1.
  7. Enable Private DNS names. This is what makes your existing Xata hostnames resolve to the endpoint inside your VPC. No DNS changes should be needed on your side. You can also enable it later from the endpoint’s Actions → Modify private DNS name.
  8. Click Create endpoint.
The Terraform equivalent:

​
Step 3 — Connect

Connect to the database endpoints as shown in the Xata console. For example:
Inside your VPC, the hostname now resolves to your endpoint’s private IPs and traffic flows over PrivateLink. From anywhere else, the same hostname resolves to the public endpoint as usual. You can verify the private path from an instance in your VPC: