Cloud Secure Link

Purpose

The Cloud Secure Link page in the Admin Console allows you to create and manage Cloud Secure Link clients that connect your Appian Cloud environment to self-hosted resources using zero-trust private connectivity.

Access

To enable Cloud Secure Link on your Appian Cloud environment, open a case with Appian Support.

Once enabled, access the Cloud Secure Link page by going to the Admin Console. Then, in the left navigation menu, click Integration, then Cloud Secure Link.

Register a client

Registering a client creates a Cloud Secure Link connection in Appian Cloud that is ready to accept the client once you install it on your infrastructure.

To register a new Cloud Secure Link client:

1. On the Cloud Secure Link page, click NEW CLIENT.

   

   Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

   The Register Client dialog displays. The registration flow has three steps: Name Your Client, Configure Resources, and Confirm Update Settings.

2. In the Name Your Client step, enter a name that uniquely identifies this client. The name must be between 1 and 128 characters. Only letters, numbers, hyphens (-), underscores (_), and colons (:) are allowed.

   

   Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

3. Click NEXT.

4. In the Configure Resources step, configure the following fields for each resource you want to connect to.

   

   Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

   These fields include:

   Field	Description
   Connection Hostname	A fully qualified domain name (FQDN) that Appian uses to route traffic to the Cloud Secure Link service, which then forwards it to the client. For example, my-database.company.com. In most scenarios, this value matches the resource hostname.
   Port	The port number used to access your resource.
   Resource Hostname	The FQDN that the Cloud Secure Link client uses to connect to the self-hosted resource. For example, my-database.company.com. This hostname does not need to be resolvable by Appian, but must be resolvable by your client.

   To successfully connect with Appian, you will need to provide the Connection Hostname in the connection string for your data source, integration object, connected system object, LDAP server connection, or SMTP host, depending on the integration.

   Keep the following in mind when configuring hostnames and ports:

   • Hostnames must be fully qualified domain names (FQDNs) with a top-level domain. For example, my-database.company.com.
   • In most scenarios, the connection hostname and resource hostname are the same. Cloud Secure Link supports separate hostnames, which lets you reach internal resources using intuitive connection hostnames.
   • Connection hostnames must be unique across all Cloud Secure Link connections in a given Appian Cloud environment.
   • Ports and resource hostnames can be reused across different Cloud Secure Link connections in the same Appian Cloud environment.

5. (Optional) Click ADD CONNECTION to add another resource to the client, then configure the fields for that resource.

   Note:  Appian recommends a single resource per client, so that each resource has its own client that intercepts, authorizes, and authenticates every request to that individual resource, creating a true zero-trust connection.

6. Click NEXT.

7. In the Confirm Update Settings step, select how the client receives updates.

   

   Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

   You can select from the following options:

   Option	Description
   Automatic Updates (recommended)	If this option is selected, Appian manages client updates automatically. By default, this option is selected.
   Manual Updates	If this option is selected, you control when updates are applied. Connections may break due to version incompatibility if the client falls too far behind.

8. Click REGISTER CLIENT. The registration confirmation dialog displays.

   

   Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

9. Copy and save the join token as a file accessible to your Cloud Secure Link client container, for example /tmp/token. This token is valid for 8 hours.

   Note:  If the cluster join token expires before you complete installation, edit the client and save without changes to generate a new token.

10. Click DOWNLOAD to download the configuration file (csl_client_<hash>_configuration.yaml), then save it to a file path accessible to your Cloud Secure Link client container.
11. Click DOWNLOAD to download the validation file (csl_client_<hash>_validation.yaml), then save it to a file path accessible to your Cloud Secure Link client container.
12. Click CLOSE.
13. Install the client using the token and files.

View and edit a client

To view or edit a client:

1. Go to the Cloud Secure Link page in the Admin Console.

   

   Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

2. In the clients list, click the client name. The Edit Client dialog displays.

   

   Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

   • The Details section of the dialog contains the following fields:

     Field	Description
     Name	The unique name identifying this client. Between 1 and 128 characters. Only letters, numbers, hyphens (-), underscores (_), and colons (:) are allowed.
     Connection Hostname	The FQDN that Appian uses to route traffic to the Cloud Secure Link service, which then forwards it to the client. In most scenarios, this matches the resource hostname.
     Port	The port number used to access your resource.
     Resource Hostname	The FQDN that the Cloud Secure Link client uses to connect to the self-hosted resource. This hostname does not need to be resolvable by Appian, but must be resolvable by your client.
     Automatic Updates	If this option is selected, Appian manages client updates automatically. By default, this option is selected.
     Manual Updates	If this option is selected, you control when client updates are applied. Connections may break due to version incompatibility if the client falls too far behind.

   • The Client Setup section of the dialog contains the following fields:

     Field	Description
     Cluster Join Token	Generates a temporary token that allows the client to authenticate with the Cloud Secure Link service during setup and maintenance tasks. Tokens are valid for up to 8 hours.
     Configuration File	Download and save this file to the server hosting the client.
     Validation File	Download and save this file to the server hosting the client.

3. In the client details panel, update the connection information or update settings as needed.

4. Click SAVE CHANGES to keep the updated settings.

   Caution:  Saving changes invalidates the existing cluster join token. The client will not reflect the changes until you re-install it using the new token.

5. To apply the changes to the running client:
   1. Copy the new cluster join token. It is valid for 8 hours.
   2. Download the updated configuration file and save it to the server hosting the client.
   3. Download the updated validation file and save it to the server hosting the client.
   4. Re-install the client using the new token and files.

Delete a client

To delete a client:

1. In the clients list, click for the client you want to delete.

2. Click DELETE CLIENT. The Delete Client? dialog displays.

   

   Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

3. Review the list of resources that will be disconnected.
4. Enter the name of the client you want to delete.
5. Click DELETE. A confirmation dialog displays.
6. Click DELETE to confirm.

Configure clients for Enhanced Business Continuity

Cloud Secure Link is compatible with Enhanced Business Continuity. Failover requires a pre-configured client in the backup region, which must be set up in coordination with Appian Support before a failover event occurs. For configuration steps, see Setting Up Cloud Secure Link.

Feedback