# Private connectivity

Reach an instance from your AWS VPC over AWS PrivateLink, and set the public, private, or dual access mode.

[AWS PrivateLink](https://aws.amazon.com/privatelink/) gives your AWS VPC a private network path to an instance that never crosses the public internet.

By default an instance is reachable over the public internet, protected by the authentication and authorisation defined inside it.

This page covers inbound connectivity, which is how clients reach the instance. For outbound requests made from queries, see [Network access](/docs/manage/instances/network-access.md).

> [!NOTE]
> PrivateLink is an enterprise feature. Onboarding is a manual process handled by the SurrealDB team and needs coordinated setup on both sides, so you cannot enable it from SurrealDB Studio. [Contact us](/contact) to start.

## Prerequisites

You need:

- An instance in a supported region.
- An AWS account with a VPC.
- AWS IAM credentials, as a user, role, or policy, permitted to create interface VPC endpoints.

## Supported regions

PrivateLink is currently available in **AWS US West (Oregon)** only. More regions will be added over time.

## How it works

After your organisation is onboarded, you create an [interface VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html) in your AWS account. The endpoint receives a private IP address inside your VPC. Traffic between your application and the instance then stays on the AWS private network, with no internet gateway, no NAT gateway, and no public hop.

Public and private paths use separate DNS namespaces and separate infrastructure.

| Path | Hostname | Reachable from |
| --- | --- | --- |
| Public | `*.aws-usw2.surreal.cloud` | The internet |
| PrivateLink | `*.privatelink.aws-usw2.surreal.cloud` | Inside your VPC only |

The two paths are isolated at the network level rather than filtered, so a misconfiguration cannot expose a private instance publicly. The PrivateLink hostname does not resolve outside the VPC.

## Access modes

Each instance in a PrivateLink-enabled region has an access mode.

| Mode | Behaviour |
| --- | --- |
| `public` | Reachable over the public internet only. The default for every instance. |
| `private` | Reachable over PrivateLink only. No public hostname is assigned. |
| `dual` | Reachable over both paths. |

Use `dual` while you migrate: bring the private path up, move clients across, confirm that nothing still connects publicly, then switch to `private`.

> [!NOTE]
> Existing instances are `public`. The `private` and `dual` modes only appear after your organisation has been onboarded for a region.

Choose the access mode when you [create an instance](/docs/manage/instances/create.md), after you select a supported region. To change it afterwards, open the instance in SurrealDB Studio and use the network settings in **Instance settings**.

## Onboarding

Enabling PrivateLink involves both your team and SurrealDB.

1. **Request access** for your organisation and region through [support](/docs/manage/organisations/support.md).
2. **SurrealDB provisions the service side** and shares the details you need.
3. **You create the interface VPC endpoint** in your AWS account with those details.
4. **SurrealDB completes the setup** and enables PrivateLink for your organisation and region.

After that, you manage access modes per instance.

## Limitations

- AWS US West (Oregon) only.
- The SurrealDB team must enable PrivateLink for your organisation before any instance can use it.
- PrivateLink hostnames resolve only inside your VPC, so you cannot use them to connect from outside AWS. Keep `dual` mode, or a separate public instance, if you also need access from developer machines or from CI outside the VPC.

## Related pages

- **[Connect to an instance](/docs/manage/instances/connect.md):** the connection routes themselves.
- **[Network access](/docs/manage/instances/network-access.md):** outbound requests from queries.
- **[Configure an instance](/docs/manage/instances/configure.md):** the rest of instance settings.