---
title: "AWS PrivateLink - Xata"
description: "Connect to your Xata Postgres databases privately from your AWS VPC, without traffic leaving the AWS network"
source: "https://xata.io/docs/platform/privatelink"
---

Skip to main content

AWS PrivateLink lets you reach your Xata databases from your own AWS VPC over the AWS private network. Traffic never traverses the public internet, and your connection strings stay exactly the same. PrivateLink is available on request. Please contact us via our regular support channels and provide us with:

- The **AWS region** of your Xata databases (e.g. `us-east-1`)
- The **AWS account ID** (or IAM role/user ARN) you will create the endpoint from.

In return we will provide you with the **service name** of the Xata VPC endpoint service to connect to. It will be in the form `com.amazonaws.vpce.us-east-1.vpce-svc-...`.

## ​How it works

Xata exposes its Postgres gateway as a VPC endpoint service. You create an **interface VPC endpoint** against it in your VPC, which places network interfaces (ENIs) with private IPs in your subnets. With private DNS enabled, your existing database hostnames (`<branch>.us-east-1.xata.tech`) resolve to those private IPs inside your VPC. This means the same connection string uses the private path from your VPC and the public path from everywhere else.

## ​Prerequisites

- A VPC in the same region and Availability Zone (AZ) as your Xata databases.
- The VPC must have **DNS support** and **DNS hostnames** enabled (`enableDnsSupport` and `enableDnsHostnames`, both on by default for most VPCs).

## ​Step 1 — Create a security group for the endpoint

The endpoint’s network interfaces need a security group that allows inbound traffic from your clients:

- TCP `5432` (Postgres wire protocol) from your application’s security group or CIDR ranges
- TCP `443` (HTTPS) from the same sources — only needed if you use the serverless HTTP driver

## ​Step 2 — Create the interface VPC endpoint

In the AWS console, go to **VPC → PrivateLink and Lattice → Endpoints** and click **Create endpoint**:

1. Optionally give the endpoint a **Name tag** (e.g. `xata`).
2. Under **Type**, select **Endpoint services that use NLBs and GWLBs** (“Find services shared with you by service name”).
3. Leave **Enable Cross Region endpoint** unchecked. Your endpoint must be in the same region as your Xata databases.
4. In the **Service name** field, paste the service name provided by Xata (`com.amazonaws.vpce.us-east-1.vpce-svc-…`) and click **Verify service**. If this fails with a permissions error, please contact us.
5. The form expands: select your VPC and one subnet per Availability Zone you want to use.
6. Attach the security group from step 1.
7. Enable **Private DNS names**. This is what makes your existing Xata hostnames resolve to the endpoint inside your VPC. No DNS changes should be needed on your side. You can also enable it later from the endpoint’s **Actions → Modify private DNS name**.
8. Click **Create endpoint**.

The Terraform equivalent:

```
resource "aws_vpc_endpoint" "xata" {
  vpc_id              = var.vpc_id
  service_name        = "<service name provided by Xata>"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = var.private_subnet_ids
  security_group_ids  = [aws_security_group.xata_endpoint.id]
  private_dns_enabled = true
}
```

## ​Step 3 — Connect

Connect to the database endpoints as shown in the Xata console. For example:

```
psql "postgresql://<user>:<password>@<branch>.us-east-1.xata.tech:5432/<database>?sslmode=verify-full"
```

Inside your VPC, the hostname now resolves to your endpoint’s private IPs and traffic flows over PrivateLink. From anywhere else, the same hostname resolves to the public endpoint as usual. You can verify the private path from an instance in your VPC:

```
dig +short <branch>.us-east-1.xata.tech
# should return private IPs from your VPC's subnets (the endpoint ENIs)
```

Was this page helpful?

[Previous](/docs/platform/compute)

[Create a production clone](/docs/tutorials/create-production-clone)

[Next](/docs/tutorials/create-production-clone)