Skip to main content

AWS PrivateLink Integration

Step-by-step guide to connect Planbase to a private database with AWS PrivateLink

Written by Jack Light

If your database is in a private network within Amazon Web Services (AWS), Planbase can connect via AWS PrivateLink.

This gives Planbase a private path to your database without making it publicly accessible or peering your VPC with Planbase.

ℹ️ AWS PrivateLink only provides network connectivity. Database access is still controlled by the credentials and permissions you configure.

Requirements

Before you start, make sure you have:

  • AWS permissions to create a Network Load Balancer and a VPC Endpoint Service

  • Access to create a dedicated database user

  • Planbase's AWS principal/account details (provided by your account team)

1. Configure the database Planbase should connect to

Where possible, point Planbase at a read replica or analytics database intended for external integrations and not your primary transactional production database.

Note the database engine, hostname, port, and database nam to share with Planbase later.

2. Set up a VPC Endpoint Service in your AWS account

In your AWS account, create a VPC Endpoint Service that fronts your database, typically through a Network Load Balancer:

  1. Create (or identify) a Network Load Balancer that targets your database.

  2. Create a VPC Endpoint Service associated with that load balancer.

  3. Confirm traffic from the VPC endpoint path to your database is allowed. PrivateLink traffic is internal to the network, so Planbase public IPs do not apply.

  4. If your load balancer uses a security group, open the load balancer Security tab, click Edit, and turn off Enforce inbound rules on PrivateLink traffic.

  5. Per AWS PrivateLink prerequisites, either enable cross-zone load balancing or register healthy targets in every Availability Zone the NLB spans.

3. Allow the Planbase AWS principal to connect

On your VPC Endpoint Service, allow access from the Planbase AWS principal.

📣 Your account team will provide our exact AWS account/principal ARN

After adding the principal:

  • Copy the full VPC Endpoint Service name:

    com.amazonaws.vpce.REGION.vpce-svc-XXXXXXXXXX

  • Note the AWS region where the service is configured

4. Create a dedicated Planbase database user

PrivateLink does not grant data access by itself. Create a dedicated database user for Planbase with only the permissions required for the integration.

In most cases, grant read-only access to the relevant tables or views.

Where appropriate, expose dedicated integration views that contain only the fields Planbase needs

5. Send connection details to your account team

Contact your Planbase account team with:

  • AWS region

  • VPC Endpoint Service name

  • Database engine

  • Database hostname / private endpoint

  • Database port

  • Database name

  • Dedicated database username

  • Tables or views Planbase should access

  • A technical contact in case of connection issues

What's next?

After you complete the steps above:

  1. Planbase creates a VPC Endpoint in our AWS environment that connects to your Endpoint Service.

  2. If your service requires manual approval of new endpoint connections, we will ask you to approve the connection request.

  3. Once connectivity is confirmed, Planbase configures the database connection and begins using it for the integration.

Did this answer your question?