Transition to Cloud Secure Link

This page describes how to migrate existing VPN or AWS PrivateLink connections to Cloud Secure Link. The migration is incremental—you can move one resource at a time without tearing down existing connections.

Transition from VPN

When to transition from VPN

Consider migrating from either static VPN or dynamic VPN to Cloud Secure Link when:

• Your infrastructure is not on AWS (Cloud Secure Link works with any cloud service provider or on-premises network).
• You want a zero-trust security model that authenticates and authorizes every connection.
• You want to reduce the operational overhead of managing VPN tunnels.
• You want to access your self-hosted resource via hostname but cannot expose your DNS server to Appian Cloud.

Migrate a resource from DNS-based VPN

If you are using DNS-based VPN routing, the same hostname cannot resolve over both VPN and Cloud Secure Link simultaneously.

To migrate a hostname from VPN to Cloud Secure Link:

1. Set up the Cloud Secure Link client and connection for the resource.
2. Continue as appropriate:
   • For static VPNs, add the subdomain to the excluded subdomains list in the Self Service VPN portal. This action removes the hostname from VPN routing.
   • For dynamic VPNs, open a case with Appian Support to make updates to the excluded subdomains list.
3. Verify that traffic to the hostname is now routing over Cloud Secure Link by testing the connected system or integration object.
4. Once verified, remove the corresponding VPN tunnel if it is no longer needed:
   • For static VPNs, see How to delete a VPN tunnel.
   • For dynamic VPNs, open a case with Appian Support.

Migrate a resource from IP-based VPN

If you are using IP-based VPN routing, both VPN and Cloud Secure Link can be active for the same environment at the same time. No subdomain exemption is required.

To migrate a resource from IP-based VPN to Cloud Secure Link:

1. Set up the Cloud Secure Link client and connection for the resource.
2. Update the connected system object for the resource to use the Cloud Secure Link hostname instead of the IP address.
3. Test the connection to confirm traffic is routing over Cloud Secure Link.
4. Once verified, remove the corresponding VPN tunnel if it is no longer needed:
   • For static VPNs, see How to delete a VPN tunnel.
   • For dynamic VPNs, open a case with Appian Support.

Revert a VPN migration

If you need to revert a migrated connection back to VPN:

• DNS-based VPN: Do the following so that traffic resumes routing over VPN:
  • For static VPNs, remove the subdomain from the excluded subdomains list in the Self Service VPN portal.
  • For dynamic VPNs, open a case with Appian Support to make updates to the excluded subdomains list.
• IP-based VPN: Update the connected system object to use the original IP address. Traffic will resume routing over VPN.

Transition from AWS PrivateLink

When to transition from AWS PrivateLink

Cloud Secure Link supports outbound connectivity only. If you are using Inbound PrivateLink for web access to your Appian Cloud environment or for Enhanced Data Pipeline, do not migrate those connections to Cloud Secure Link. Inbound PrivateLink has no Cloud Secure Link equivalent.

Consider migrating from outbound PrivateLink to Cloud Secure Link when:

• You have resources not hosted in AWS or you want to reduce dependency on AWS infrastructure.
• You want self-service connection management without opening Appian Support cases for any changes.
• You want a zero-trust security model that authenticates and authorizes every connection.
• You want to simplify your network configuration by eliminating the Virtual Private Cloud (VPC) endpoint service, Network Load Balancer, and associated AWS resources.

Migrate an outbound PrivateLink resource

Because the outbound PrivateLink setup is Appian-managed, Cloud Secure Link and AWS PrivateLink cannot both route traffic to the same resource simultaneously when using the same hostname. Be sure to set up Cloud Secure Link fully before removing the PrivateLink connection.

To migrate an outbound PrivateLink connection to Cloud Secure Link:

1. Set up the Cloud Secure Link client and connection for the resource.
2. Open a case with Appian Support to remove the outbound PrivateLink VPC endpoint from your Appian Cloud environment.
3. (Optional) If the AWS VPC endpoint service, Network Load Balancer, and related resources were used solely for this PrivateLink connection, decommission them in your AWS account.

Revert an outbound PrivateLink migration

If you need to revert to PrivateLink before decommissioning your AWS resources:

1. Open a case with Appian Support to restore the PrivateLink VPC endpoint on your Appian Cloud environment.
2. Once Appian confirms the PrivateLink connection is restored, delete the Cloud Secure Link client in the Admin Console or update the connected system object to use the PrivateLink hostname.

Coexistence scenarios

Cloud Secure Link can coexist with VPN and/or AWS PrivateLink on the same environment:

• Use Cloud Secure Link for outbound connections where zero-trust security and self-service management are preferred.
• Keep VPN or AWS PrivateLink for inbound access, or for resources not yet migrated to Cloud Secure Link.
• Different resources on the same environment can use different connectivity options simultaneously.

Feedback