Connect with Cloud Secure Link

This page applies to system administrators using Cloud Secure Link. It describes what Cloud Secure Link is, how it works, and what you need to get started.

What is Cloud Secure Link?

Cloud Secure Link provides outbound connectivity from Appian Cloud to your self-hosted resources using a zero-trust security model. Cloud Secure Link works with any cloud service provider or on-premises network and does not require AWS infrastructure. Cloud Secure Link fully supports cross-region connectivity use cases.

Cloud Secure Link is powered by Teleport, an identity platform that uses token-based authentication to provide least-privileged access to resources within a network. Cloud Secure Link runs a lightweight client container alongside your self-hosted resources. The client establishes an encrypted reverse tunnel back to Appian Cloud, enabling secure communication without opening inbound firewall ports.

Connections are established only after a resource has been authenticated and authorized using mTLS certificates.

High-level architecture

Cloud Secure Link consists of two components:

• Secure Link Service: An Appian-managed service that establishes connections between Appian Cloud environments and Secure Link Clients deployed on self-managed networks.
• Secure Link Client: A lightweight client deployed within your network to receive and forward traffic from the Cloud Secure Link service.

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

Your Appian Cloud environment sends outbound requests to your self-hosted resource through the Cloud Secure Link service. The Cloud Secure Link service forwards TCP traffic to the corresponding Cloud Secure Link client through a mutually authenticated, encrypted connection. The Cloud Secure Link client then forwards this traffic to your self-managed resource.

Client

The Cloud Secure Link client initiates the connection to the Cloud Secure Link service. Deploy the client using a container image on your infrastructure. Appian recommends running a Kubernetes cluster to deploy your image.

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

Connectivity between the service and client is always initiated from the client side. Once the client establishes a connection to the service, that connection is used to forward traffic to the self-managed resource. No inbound ports need to be opened on your firewall. The Cloud Secure Link client must be able to connect to the self-managed resource.

You can configure one Cloud Secure Link client to connect to multiple resources.

Automatic client updates

By default, Cloud Secure Link deploys an automatic update service alongside the client binary inside the container. When Appian signals that an update is required, the update service pulls the latest version of the client binary. The update process gracefully restarts the client binary. A new process forks running the latest version and serves all new connection requests, while the old process finishes handling in-flight connections before shutting down. Restarts are performed off-hours and experience no downtime.

Appian strongly recommends keeping automatic updates enabled. Connection failures may occur if the client version becomes incompatible with the Secure Link Service version running on Appian Cloud.

Automatic updates apply only to the client binary, not the client container image. When Appian releases a new container image version, you will need to pull the updated image from Appian's registry, push it to your own container registry, and update your deployment. In a Kubernetes cluster, this update only requires a single helm upgrade command. In a standalone Docker deployment, the update requires manually stopping and recreating the container. For this reason, Appian strongly recommends deploying Cloud Secure Link in a Kubernetes cluster.

Security features

• Reverse SSH: The Cloud Secure Link client establishes connectivity from within your network by establishing a reverse SSH tunnel back to Appian Cloud. This lets you establish secure connectivity without managing inbound firewall policies within your network.
• Mutual TLS: All connections between the Cloud Secure Link service and the Cloud Secure Link client are encrypted with mutual TLS (mTLS).
• Hostnames and traffic routing: Appian Cloud does not need to resolve the hostnames of your self-hosted resources to reach them over Cloud Secure Link. You can use a private DNS server to route from your Cloud Secure Link client to your resources without exposing your DNS server to Appian.
• Microsegmentation: Isolate network zones by segmenting networks into smaller subnets, each exposed by a Cloud Secure Link client.
• No lateral movement: Each client enables connectivity for the specific resources configured at the client level. Lateral movement across the network is not possible (e.g. IP crawling).

Requirements

• License: Cloud Secure Link is available with an Advanced or Premium Appian Cloud license. An additional license fee is required. To enable Cloud Secure Link, open a support case with Appian Support.
• Maximum Connections: Customers with Advanced and Premium Appian Cloud licenses can use up to 500 Cloud Secure Link connections across their Appian Cloud environments.
• Regional availability: Cloud Secure Link is available in all supported Appian Cloud regions, with the following exceptions:
  • GovCloud environments
  • PCI-compliant environments
  • Canada Protected B environments
  • Cyber Essentials Plus environments
  • Osaka and Tokyo environments that use Enhanced Business Continuity

  Note:   Cloud Secure Link is not supported for Dedicated Customer Virtual Private Cloud environments. It is compatible with Enhanced Business Continuity.

• Client installation: Your organization must be able to install and enable the Cloud Secure Link client within your infrastructure. The Cloud Secure Link client must be able to send traffic to the Cloud Secure Link service over the public internet. If you plan to deploy multiple client replicas for high availability (HA), confirm your infrastructure can provide each replica with isolated storage, as described in the HA requirements.
• Containerization: Appian requires that you deploy Cloud Secure Link using Kubernetes or Docker. Appian strongly recommends Kubernetes. Appian does not provide non-containerized Cloud Secure Link client binaries.
• Self-hosted resource configuration: Appian recommends deploying Cloud Secure Link as close as possible to your self-hosted resource. The Cloud Secure Link client must be able to reach the resource on your network.
• System requirements: Ensure you have the following resources available to run the Cloud Secure Link client:
  • RAM: 512 MB
  • CPU: 1 vCPU

Supported integrations

Cloud Secure Link supports most outbound connectivity to your self-hosted resources.

However, the following capabilities are not supported for Cloud Secure Link:

• Inbound access to Appian Cloud over Cloud Secure Link
• Log streaming
• Autoscale processes
• Enhanced Data Pipeline (EDP)
• Data Fabric - Direct Data Access

Browsing these pages

The pages in this browser cover everything you need to set up and manage Cloud Secure Link:

• Setting Up Cloud Secure Link: Download the client artifacts, deploy the client using Kubernetes or Docker, and connect your self-hosted resources.
• Admin Console: Cloud Secure Link: Reference for the client administration interface in the Admin Console, including how to register clients, configure connections, and manage update settings.
• Transitioning to Cloud Secure Link from VPN or PrivateLink: How to migrate existing VPN or PrivateLink connections to Cloud Secure Link incrementally.

Feedback