Contact Us 1-800-596-4880
  1. Homepage
  2. CloudHub 2.0
  3. Features of CloudHub 2.0
  4. Private Spaces

  5. Inbound Private Link

Setting Up an Inbound Private Link Connection

With AWS PrivateLink you can reach the Mule applications deployed in your CloudHub 2.0 private space privately from your own AWS accounts, without traversing the public internet. An inbound Private Link connection publishes your private space’s internal Network Load Balancer (NLB) as an AWS endpoint service. You then create interface VPC endpoints in your own VPCs or private spaces that connect to that endpoint service, so traffic reaches your private-space apps over the AWS network at OSI layer 4.

Unlike an outbound Private Link connection, where the private space consumes an AWS-hosted service, an inbound connection makes the private space the provider. MuleSoft owns the endpoint service, and you own the consuming VPC endpoints or the VPC endpoint in the consumer private space.

Manage inbound Private Link connections using the Runtime Fabric API. The examples on this page use curl`. Replace the placeholder values with your organization ID, private space ID, and access token.

Before You Begin

Before you configure an inbound Private Link connection, ensure that you have:

  • A private space that wasn’t created by the VPC upgrade tool. To use inbound Private Link when migrating from CloudHub, create a new private space. See Create a New Private Space Manually.

  • Inbound Private Link enabled for your organization. This feature is enabled per organization. If it isn’t enabled, calls to the endpoint service return 403 with the message Inbound PrivateLink feature is not enabled for this organization. To request access, contact your account team or Support.

  • A private space that is fully provisioned and in a ready state. See Creating and Configuring a Private Space.

  • Permission to manage the private space. You can manage the endpoint service only from the organization that owns the private space, not from an organization that shares the space with it.

  • One or more AWS IAM principal ARNs that you want to authorize to connect, and access to those accounts to create interface VPC endpoints. For the accepted ARN formats, see Configure the Inbound Connection .

  • A bearer token to call the API.

    To get a bearer access token for your Anypoint organization, follow the instructions from Anypoint identity or external identity. The token owner requires permission to manage private spaces.

The Endpoint Service Resource

All inbound Private Link operations act on a single resource:

https://anypoint.mulesoft.com/runtimefabric/api/organizations/{orgId}/privatespaces/{privateSpaceId}/endpointservice
Method Purpose Response

POST

Create the endpoint service for the private space.

201 (returns true)

GET

Read the endpoint service and its live AWS status.

200 (EndpointServiceResponse)

PATCH

Update the authorized principals and/or connected VPC endpoints.

200 (returns true)

DELETE

Remove the endpoint service.

204

All requests are authenticated using a bearer token and authorized against the organization that owns the private space. A request for a space that your token can’t see returns 404. A request without sufficient permissions returns 403. A GET request also returns 404 when the private space exists without an endpoint service, such as when you send a GET request before a POST request.

Configure the Inbound Connection

Create the endpoint service, and authorize the AWS accounts (principals) to connect.

The request body accepts these properties:

principals

Required. An array of AWS IAM principal ARNs authorized to create interface VPC endpoints for this endpoint service. Only these principals can connect. Use the full ARN form, such as arn:aws:iam::<account-id>:root, to authorize an entire account, or arn:aws:iam::<account-id>:role/<role-name> for a specific role or user.

vpcEndpoints

Optional (defaults to []). An array of your interface VPC endpoint IDs authorized to connect to the endpoint service. This array is usually empty at creation time because you can’t add endpoint IDs until the endpoint service exists. You supply endpoint IDs later using a PATCH request.

MuleSoft resolves your private space’s internal load balancer automatically. A private space can have only one endpoint service. A second POST returns 400.

To create the endpoint service:

curl -X POST \
  "https://anypoint.mulesoft.com/runtimefabric/api/organizations/$ORG/privatespaces/$PS/endpointservice" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
        "principals": ["arn:aws:iam::111122223333:root"]
      }'

A 201 response indicates that the request succeeded. MuleSoft then asynchronously completes these actions:

  • Provisions the AWS endpoint service in front of your private space’s internal NLB.

  • Authorizes your principals.

  • Assigns the internal NLB domain as your private DNS name.

  • Verifies domain ownership.

  1. Check for the endpoint service name: Because provisioning is asynchronous, the resource updates the status when the service becomes available and populates the endpointServiceName:

    curl \
  "https://anypoint.mulesoft.com/runtimefabric/api/organizations/$ORG/privatespaces/$PS/endpointservice" \
  -H "Authorization: Bearer $TOKEN"

    A representative EndpointServiceResponse:

    {
  "endpointServiceName": "com.amazonaws.vpce.us-east-1.vpce-svc-0123456789abcdef0",
  "serviceOwner": "123456789012",
  "status": "Available",
  "baseEndpointDnsNames": [
    "vpce-svc-0123456789abcdef0.us-east-1.vpce.amazonaws.com"
  ],
  "privateDnsName": "*.internal-012abc.usa-e1.cloudhub.io",
  "principals": ["arn:aws:iam::111122223333:root"],
  "vpcEndpoints": [
    {
      "awsId": "vpce-0abc123def4567890",
      "serviceName": "com.amazonaws.vpce.us-east-1.vpce-svc-0123456789abcdef0",
      "status": "available",
      "message": null,
      "dnsEntries": ["vpce-0abc123def4567890-a1b2c3d4.vpce-svc-0123456789abcdef0.us-east-1.vpce.amazonaws.com"],
      "connectableAZs": ["us-east-1a", "us-east-1b"]
    }
  ]
}

    If the endpoint service exists in the configuration but hasn’t been provisioned in AWS, status returns unknown. Wait for the endpoint service to become available before continuing.

  2. Create interface VPC endpoints in your AWS account: In each of your VPCs, create an interface VPC endpoint that targets the endpointServiceName returned above. Choose subnets in availability zones that overlap the service’s connectableAZs, and attach a security group that permits traffic to your application ports.

    If the consumer is another CloudHub 2.0 private space instead of a VPC in your AWS account, create the VPC endpoint in that private space using the outbound Private Link flow. Specify endpointServiceName as the service name. For setup instructions, see Setting Up an Outbound Private Link Connection.

  3. Register your VPC endpoint IDs with MuleSoft so that the endpoint service can accept connections: Unregistered endpoint IDs remain in pendingAcceptance on the endpoint service.

    curl -X PATCH \
  "https://anypoint.mulesoft.com/runtimefabric/api/organizations/$ORG/privatespaces/$PS/endpointservice" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
        "vpcEndpoints": ["vpce-0abc123def4567890"]
      }'

  4. Resolve your application hostnames to the endpoint: CloudHub 2.0 ingress selects the target application by its hostname, which belongs to the private space’s internal domain, such as {app}.internal-{id}.{region}.cloudhub.io. Ensure that the private space’s TLS certificate matches that domain.

    To resolve application hostnames, enable private DNS on your interface VPC endpoint. MuleSoft verifies domain ownership of privateDnsName. Because privateDnsName is a wildcard domain (*.internal-{id}.{region}.cloudhub.io) that covers application hostnames one level below it, private DNS resolves hostnames to the endpoint inside your VPC.

    Alternatively, map each application hostname to the endpoint. For example, create a CNAME record in a Route 53 private hosted zone that points the application hostname to one of the endpoint’s dnsEntries.

Update an Inbound Connection

Use PATCH to change the authorized principals or the set of connected VPC endpoints over time. Each field uses replace-if-present semantics:

Field state Effect

Omitted (null)

Left unchanged.

Present with values

Replaces the current list entirely.

Present as []

Clears the list.

Removing a VPC endpoint ID from vpcEndpoints, or clearing the list with [], doesn’t automatically disconnect an endpoint that’s already connected. First, take action on the consumer side.

To disconnect an endpoint:

  1. On the consumer side, remove the endpoint from the connection, or delete the interface VPC endpoint if it’s attached to another private space.

  2. Remove that VPC endpoint ID from vpcEndpoints using a PATCH request.

Removing the owning principal using a PATCH request prevents that principal from creating new endpoints, but doesn’t tear down established connections.

For example, to authorize an additional AWS account without affecting connected endpoints, provide the full list of principals and omit vpcEndpoints:

curl -X PATCH \
  "https://anypoint.mulesoft.com/runtimefabric/api/organizations/$ORG/privatespaces/$PS/endpointservice" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
        "principals": [
          "arn:aws:iam::111122223333:root",
          "arn:aws:iam::444455556666:root"
        ]
      }'

Delete an Inbound Connection

Before you delete the endpoint service, disconnect every consuming VPC endpoint. On the consumer side, remove each endpoint from the connection, or delete the interface VPC endpoint if it’s attached to another private space. If VPC endpoints remain connected, removing the AWS endpoint service fails.

To remove the endpoint service, delete the resource:

curl -X DELETE \
  "https://anypoint.mulesoft.com/runtimefabric/api/organizations/$ORG/privatespaces/$PS/endpointservice" \
  -H "Authorization: Bearer $TOKEN"

A 204 response indicates that MuleSoft cleared the configuration. MuleSoft removes the underlying AWS endpoint service asynchronously, rather than immediately when the 204 response returns.

After establishing a connection, complete these steps to reach private space applications using the interface VPC endpoint:

  1. Verify that your route tables, network ACLs, and security groups permit traffic from your workloads to the endpoint network interfaces.

  2. Add an inbound firewall rule on the private space to permit HTTP/HTTPS traffic from your consumer-side CIDR block. Use the CIDR of the client subnets or VPC that originate requests, rather than the interface VPC endpoint subnet. Without this rule, the private space blocks traffic arriving over the endpoint service. See Creating and Configuring a Private Space.

  3. Point requests to the application hostname resolving to the interface VPC endpoint. See Establish the Private Link Connection.

Traffic flows privately over AWS PrivateLink to your private space internal NLB and to your deployed apps.

Endpoint Service Response Reference

The GET response (EndpointServiceResponse) contains:

Field Description

endpointServiceName

The service name you use to create interface VPC endpoints in your AWS account.

serviceOwner

The AWS account ID that owns the endpoint service (the private space’s account).

status

The provisioning and availability status of the endpoint service. Returns unknown before AWS provisioning completes.

baseEndpointDnsNames

The regional DNS names of the endpoint service.

privateDnsName

The private DNS name assigned to the endpoint service (your private space’s internal domain).

principals

The AWS principals currently authorized to connect.

vpcEndpoints

The live status of each connected interface VPC endpoint: awsId, serviceName, status, message (an error description returned if the endpoint fails), dnsEntries, and connectableAZs.

Entitlements

Each endpoint service consumes one network connection entitlement from your quota. A private space can have only one endpoint service, but you can create an endpoint service in each private space. Creating an endpoint service when no entitlements remain returns a 400 response indicating that you reached the network connection limit.

Interface VPC endpoints count only on the consumer side, against the quota of the private space where you add the VPC endpoint. They don’t count against the endpoint service.

Limitations

  • A private space supports only one inbound endpoint service.

  • The endpoint service is available only in the private space’s AWS region. Create consuming interface VPC endpoints in that same region.

  • Manage the endpoint service only from the organization that owns the private space, not from an organization that shares the private space.

  • Provisioning is asynchronous. The endpoint service isn’t available immediately when the POST request returns. Poll GET before creating VPC endpoints.

  • CMuleSoft rejects create and update requests while deleting a private space.

See Also