Private networking
Reach managed databases over VPC PrivateLink instead of public endpoints, with private-only hostnames.
Private networking lets your applications reach managed databases over a private VPC connection (PrivateLink) instead of a public endpoint — no IP allowlist required. It's managed under a workspace's Network page.
Private networking requires the Business plan or higher.
Model
You create an endpoint service (per provider and region), then register
the interface VPC endpoints that may reach it. Relay publishes <name>-pl-<n>
hostnames that resolve only inside your VPC.
Registering an endpoint (AWS)
Create the endpoint service in the region you need. Once published, Relay shows a
copyable service name (e.g. com.amazonaws.vpce.<region>.vpce-svc-…).
The dashboard renders an aws ec2 create-vpc-endpoint command (type Interface)
prefilled with the service name — you fill in your VPC, subnet, and security-group
IDs locally. These values only shape the command; they are never sent to Relay.
Run the command, then register the resulting VPC endpoint ID (vpce- followed
by 8 or 17 hex characters). This ID is the only value sent to Relay.
Endpoints move through statuses (pending → available), and the service reports its
own status. Deleting an endpoint stops its -pl-<n> hostnames from resolving and
drops connections through it; deleting a service means new endpoints in that region
need a new service.
New endpoint services are created for AWS regions today.
Once an endpoint is available, choose the Private endpoint surface in a cluster's Connect panel.