AWS PrivateLink gives your AWS VPC a private network path to an instance that never crosses the public internet.
By default an instance is reachable over the public internet, protected by the authentication and authorisation defined inside it.
This page covers inbound connectivity, which is how clients reach the instance. For outbound requests made from queries, see Network access.
PrivateLink is an enterprise feature. Onboarding is a manual process handled by the SurrealDB team and needs coordinated setup on both sides, so you cannot enable it from SurrealDB Studio. Contact us to start.
Prerequisites
You need:
An instance in a supported region.
An AWS account with a VPC.
AWS IAM credentials, as a user, role, or policy, permitted to create interface VPC endpoints.
Supported regions
PrivateLink is currently available in AWS US West (Oregon) only. More regions will be added over time.
How it works
After your organisation is onboarded, you create an interface VPC endpoint in your AWS account. The endpoint receives a private IP address inside your VPC. Traffic between your application and the instance then stays on the AWS private network, with no internet gateway, no NAT gateway, and no public hop.
Public and private paths use separate DNS namespaces and separate infrastructure.
| Path | Hostname | Reachable from |
|---|---|---|
| Public | *.aws-usw2.surreal.cloud | The internet |
| PrivateLink | *.privatelink.aws-usw2.surreal.cloud | Inside your VPC only |
The two paths are isolated at the network level rather than filtered, so a misconfiguration cannot expose a private instance publicly. The PrivateLink hostname does not resolve outside the VPC.
Access modes
Each instance in a PrivateLink-enabled region has an access mode.
| Mode | Behaviour |
|---|---|
public | Reachable over the public internet only. The default for every instance. |
private | Reachable over PrivateLink only. No public hostname is assigned. |
dual | Reachable over both paths. |
Use dual while you migrate: bring the private path up, move clients across, confirm that nothing still connects publicly, then switch to private.
Existing instances are public. The private and dual modes only appear after your organisation has been onboarded for a region.
Choose the access mode when you create an instance, after you select a supported region. To change it afterwards, open the instance in SurrealDB Studio and use the network settings in Instance settings.
Onboarding
Enabling PrivateLink involves both your team and SurrealDB.
Request access for your organisation and region through support.
SurrealDB provisions the service side and shares the details you need.
You create the interface VPC endpoint in your AWS account with those details.
SurrealDB completes the setup and enables PrivateLink for your organisation and region.
After that, you manage access modes per instance.
Limitations
AWS US West (Oregon) only.
The SurrealDB team must enable PrivateLink for your organisation before any instance can use it.
PrivateLink hostnames resolve only inside your VPC, so you cannot use them to connect from outside AWS. Keep
dualmode, or a separate public instance, if you also need access from developer machines or from CI outside the VPC.
Related pages
Connect to an instance: the connection routes themselves.
Network access: outbound requests from queries.
Configure an instance: the rest of instance settings.