Configuring Inbound Access over AWS PrivateLink

Overview

This page documents how to configure an Appian Cloud environment for access over AWS PrivateLink. For an overview of integrating with Appian Cloud using AWS PrivateLink, see AWS PrivateLink integration with Appian Cloud.

Use Cases

Enhanced Data Pipeline over PrivateLink

A PrivateLink integration may be used to provide the network connectivity required for the Enhanced Data Pipeline feature.

Inbound Web Access over PrivateLink

By default, Appian Cloud environments receive all inbound web traffic through the public Internet. Upon request, Appian can configure an Appian Cloud environment to require web traffic to go through a PrivateLink connection. In this configuration, the environment will not be accessible over the Internet.

In this configuration, additional network considerations are required to use Appian DevOps features such as Compare and Deploy Across Connected Environments. The recommended way to enable Appian DevOps features for environments with Private Access over PrivateLink is to enable Connected Environments. For more details, see Configuring Connected Environments for Private Access.

Alternatively, you can also request to configure your Appian Cloud environment in dual mode, to receive inbound web traffic over the Internet and the PrivateLink connection. See Configuring Dual Inbound Access for prerequisites and details on how to set up your environments in dual mode.

Architecture

To integrate with AWS PrivateLink, the Appian Cloud environment is exposed as a service provider using an AWS VPC endpoint service. To use this endpoint service, you need to create an interface VPC endpoint inside your VPC to access the Appian Cloud environment for each of your Appian Cloud environments.

In the diagram below, an EC2 instance in a customer VPC sends requests to the interface VPC endpoint, showing the end-to-end traffic flow.

Prerequisites

	Prerequisite steps	Description	Organizational role
1	Create AWS principals	In order to access the Appian Cloud environment, you will need to provide Appian with a list of AWS principals that will send connection requests to the endpoint service.	Customer AWS Administrator
2	Create a VPC	Once Appian has created a VPC endpoint service, you will be required to create resources in a VPC in the same region and availability zones as the Appian Cloud environment.	Customer AWS Administrator
3	Create a support case	Open a support case with Appian Support. Include the following information: Principals: The ARN-formatted AWS principals that can access the endpoint (e.g. arn:aws:iam::123456789012:root). These are the principles created in the previous step. Use Case: The purpose of the connection - either Enhanced Data Pipeline or Inbound Web Access.	Customer Business Relationship Owner

Setup

Once the prerequisite steps above have been completed, Appian Support will work with you through the following configuration procedure.

	Configuration action	Description	Owner
1	Create VPC endpoint service	Appian will create a VPC endpoint service that can be connected to with the provided AWS principals. Appian will share the endpoint service details with you.	Appian
2	Configure the Appian Cloud environment	Any required configurations will be applied to the affected environment.	Appian
3	Create an interface VPC endpoint	You will create an interface VPC endpoint that connects to the VPC endpoint service using the details provided by Appian.	Customer AWS Administrator
4	Schedule a maintenance window for the affected environments	Appian Support will work with you to schedule maintenance windows for the affected environment.	Appian
5	Set up name resolution	Update your DNS infrastructure so the main, static, and dynamic fully qualified domain names (FQDNs) of your Appian Cloud environment resolve to the private IP address associated with the interface VPC endpoint you created in the previous step. This configuration is required whether your environment uses an Appian owned domain (appiancloud.com or appiancloud.us) or a custom domain. Caution:  Your Appian Cloud environment will not be accessible until this step is completed. You should plan to complete this step as close to the scheduled maintenance window as possible.	Customer Network Administrator
6	Verify the integration works as expected	Appian Support will work with you to ensure connectivity to the Appian Cloud environment is working as expected.	Appian / Customer Business Relationship Owner

Enhanced Business Continuity and Inbound PrivateLink

If you have purchased Enhanced Business Continuity, Appian supports pre-configured standby inbound PrivateLink connections to your secondary Appian Cloud region. By pre-configuring a standby VPC endpoint service in your secondary Appian Cloud region, you can connect to Appian from either of the following:

• A backup interface VPC endpoint in your secondary AWS region, or
• The main interface VPC endpoint in your primary AWS region using cross-region PrivateLink.

You are responsible for configuring your DNS to route traffic to the correct interface VPC endpoint during a failover event.

Requirements

To use pre-configured inbound PrivateLink connectivity for Enhanced Business Continuity, you must adhere to the following requirements:

1. Enhanced Business Continuity: Standby failover inbound PrivateLink connectivity is not available unless you have purchased Enhanced Business Continuity.
2. VPC availability: You must have a VPC available in your secondary region to host your secondary interface VPC endpoint.
3. DNS failover capability: You must have a DNS failover mechanism in place to redirect inbound traffic to the appropriate interface VPC endpoint during a failover event. Appian will pre-configure the endpoint services with cross-region support.

Supported regions

Appian will only configure cross-region connectivity between your primary and secondary regions for Enhanced Business Continuity. Inbound connections from any other AWS regions are not supported.

Setup

To set up pre-configured standby inbound PrivateLink for Enhanced Business Continuity, the following steps are required:

	Action	Description	Owner
1	Create a support case	Open a support case with Appian Support. Include the following information: Principals: The ARN-formatted AWS principals that will connect to the secondary endpoint service (for example, arn:aws:iam::123456789012:root). Consumer region: The AWS region from which your interface VPC endpoint will connect to the secondary endpoint service.	Your Business Relationship Owner
2	Configure endpoint service	Appian will create a VPC endpoint service in your secondary Appian Cloud region, configured to accept traffic from your specified consumer region. Appian will share the endpoint service details with you.	Appian
3	Create an interface VPC endpoint	Create an interface VPC endpoint in your consumer region that connects to the secondary endpoint service using the details provided by Appian.	Your AWS Administrator
4	Configure DNS failover	Configure your DNS infrastructure to route traffic to the correct interface VPC endpoint during a failover event.	Your Network Administrator
5	Verify connectivity	Appian Support will work with you to validate that the secondary endpoint service is correctly configured and that your interface VPC endpoint can connect to it.	Appian / Your Business Relationship Owner

Feedback