Skip to main content

AWS PrivateLink

Available on request

PrivateLink connectivity is an enterprise offering. It is not self-service and is not generally available by default. Contact the OpsWorker team to set it up.

Overview​

SaaS deployment with private network connectivity. Instead of the public internet, the Kubernetes Agent reaches OpsWorker over AWS PrivateLink, so investigation data does not traverse public networks.

How It Works​

graph LR
    Agent[K8s Agent] -->|PrivateLink| VPCEndpoint[VPC Endpoint]
    VPCEndpoint -->|Private network| OW[OpsWorker SQS]

The agent connects to an AWS VPC Endpoint in your account, which routes traffic to OpsWorker's SQS queues over AWS's private network backbone. The agent remains read-only and outbound-only.

What It Offers​

  • Private networking. Cluster data does not travel over the public internet.
  • Managed backend. OpsWorker still runs the platform; this changes only the network path.
  • Compliance-friendly. Helps satisfy private networking requirements.
  • Reduced attack surface. No reliance on a public endpoint for agent traffic.

Considerations​

  • Requires VPC Endpoint configuration in your AWS account.
  • Small additional AWS cost for the VPC Endpoint.
  • Available for AWS-hosted clusters (EKS, or self-hosted on EC2).

Best For​

  • Organizations that require private network connectivity
  • Security policies that prohibit public internet communication for cluster data
  • Teams that want a managed backend without public network exposure

Getting Started​

This setup is arranged directly with the OpsWorker team. Contact OpsWorker to enable PrivateLink. The team will provide the VPC Endpoint Service name, guide VPC Endpoint creation in your account, and configure the agent to use the PrivateLink endpoint.

Next Steps​