# AWS PrivateLink for Nexus Repository Cloud

Nexus Repository Cloud supports AWS PrivateLink, which allows applications in your AWS VPC to connect to your tenant through the AWS private network instead of the public internet.

## Overview

When AWS PrivateLink is enabled for your tenant, Sonatype provisions a dedicated VPC endpoint service. You create an interface VPC endpoint in your AWS account and connect it to the service.

Your Nexus Repository Cloud tenant URL remains unchanged. With private DNS enabled, clients inside your VPC resolve the tenant hostname to private IP addresses associated with the interface endpoint.

Applications in your AWS VPC connect to Nexus Repository Cloud through an interface VPC endpoint. Sonatype manages the endpoint service and tenant infrastructure.

## How PrivateLink Works

PrivateLink operates on a per-tenant basis. Sonatype provisions a dedicated VPC endpoint service for each participating tenant.

The traffic path is: Your VPC → Interface VPC Endpoint → AWS private network → Dedicated Load Balancer → Your Nexus Repository tenant.

The setup process consists of the following steps:

1. Request PrivateLink access and provide your AWS account information.
2. Sonatype provisions a dedicated endpoint service for your tenant.
3. Sonatype provides the VPC endpoint service name.
4. Create an interface VPC endpoint in your AWS account.
5. Validate connectivity and confirm successful validation with Sonatype.
6. Sonatype completes the cutover to PrivateLink-only mode if you selected that access mode.

Sonatype provisions the endpoint service alongside your existing public connection. Your current access remains available throughout provisioning.

## Access Modes

Nexus Repository Cloud supports AWS PrivateLink in the following access modes:

| Mode            | Public Endpoint | Public DNS Record                          | PrivateLink endpoint | Best for                                               |
|-----------------|------------------|--------------------------------------------|----------------------|--------------------------------------------------------|
| Dual access     | Enabled          | Points to your tenant                     | Enabled              | Maintaining both public and private connectivity       |
| PrivateLink only | Disabled         | None - tenant is unreachable from the public internet | Enabled              | Restricting access to AWS PrivateLink only              |

Dual access is recommended during initial validation and rollout. After validating connectivity, you can request a transition to PrivateLink-only access if required.

## Prerequisites

Before requesting AWS PrivateLink, ensure that you have:

- A paid Nexus Repository Cloud subscription. AWS PrivateLink is available to all paid Nexus Repository Cloud customers.
- An AWS account in a supported region:
  - us-east-1
  - us-west-2
  - eu-west-1
  - eu-central-1
  - ap-southeast-2
  - ap-southeast-4
- A VPC in the same AWS region as your Nexus Repository Cloud tenant.
- Permissions to:
  - Create interface VPC endpoints (`ec2:CreateVpcEndpoint`)
  - Manage security groups (`ec2:AuthorizeSecurityGroupIngress`, `ec2:CreateSecurityGroup`)
  - Describe VPC endpoint services (`ec2:DescribeVpcEndpointServices`)
- The Nexus Repository Cloud tenant URL.
- The AWS account ID or IDs that require access.

**Note**

The interface VPC endpoint must be created in the same AWS region as the Nexus Repository Cloud tenant.

## Request AWS PrivateLink

To enable AWS PrivateLink for your tenant, submit a request through Sonatype Support and include the following information:

| Information        | Example                |
|---------------------|------------------------|
| Tenant URL          | `acme.repo.sonatype.app` |
| AWS account ID(s)   | `123456789012`          |
| AWS region          | `us-east-1`            |
| Access mode         | `Dual access` or `PrivateLink only` |

After provisioning is complete, Sonatype provides:

- The VPC endpoint service name.
- Your tenant URL.
- Access mode configuration details.

## Identify Supported Availability Zones

The interface VPC endpoint must be created in Availability Zones supported by the endpoint service.

Use the AWS CLI to identify supported Availability Zones:

```
aws ec2 describe-vpc-endpoint-services \
    --service-names <vpc_endpoint_service_name> \
    --query 'ServiceDetails[0].AvailabilityZones'
```

Select subnets in the supported Availability Zones for endpoint creation.

## Create the Interface VPC Endpoint

Before creating the endpoint, choose how clients in your VPC will resolve your tenant hostname.

| DNS Option                            | Description |
|---------------------------------------|-------------|
| AWS-managed Private DNS               | AWS automatically resolves the tenant hostname to the endpoint's private IP addresses. |
| Split-horizon DNS                     | You manage private DNS records in your own DNS infrastructure. |

Replace the example values with values from your AWS environment.

Private DNS allows clients inside the VPC to continue using the standard tenant URL while routing traffic through the interface endpoint.

### AWS-Managed Private DNS

Create the endpoint and enable private DNS:

```
aws ec2 create-vpc-endpoint \
    --vpc-id vpc-XXXXXXXX \
    --service-name <vpc_endpoint_service_name> \
    --vpc-endpoint-type Interface \
    --subnet-ids subnet-aaa subnet-bbb subnet-ccc \
    --security-group-ids sg-XXXXXXXX \
    --private-dns-enabled
```

**Note**

The endpoint is automatically accepted. You do not need to approve it manually. Use the same AWS account that you provided to Sonatype when you requested PrivateLink. If the endpoint does not reach the `Available` state, verify the AWS account ID and contact your Sonatype representative for assistance.

Replace the placeholder values with values from your environment.

AWS automatically resolves your tenant hostname to the endpoint's private IP addresses for clients inside the VPC.

Your VPC must have the following settings enabled:

- enableDnsSupport
- enableDnsHostnames

**Creating Endpoint through the AWS Management Console**

1. Go to _VPC_ > _Endpoints_ and select _Create Endpoint_.
2. Under _Other endpoint services_, enter the service name provided by Sonatype.
3. Select your VPC and the subnets where the endpoint will be deployed.
4. Attach a security group that allows inbound TCP 443 from the CIDR blocks or security groups of your clients.
5. Enable _Private DNS_ names if required for your deployment.
6. Review the configuration and select _Create Endpoint_.

After the endpoint is created, validate connectivity and notify Sonatype to complete the cutover process.

### Split-Horizon DNS

Create the endpoint without enabling private DNS:

```
aws ec2 create-vpc-endpoint \
    --vpc-id vpc-XXXXXXXX \
    --service-name <vpc_endpoint_service_name> \
    --vpc-endpoint-type Interface \
    --subnet-ids subnet-aaa subnet-bbb subnet-ccc \
    --security-group-ids sg-XXXXXXXX
```

**Note**

Retrieve the endpoint network interface IDs:

```
aws ec2 describe-vpc-endpoints \
    --vpc-endpoint-ids <endpoint-id> \
--query 'VpcEndpoints[0].NetworkInterfaceIds'
```

Retrieve the private IP address for each network interface:

```
aws ec2 describe-network-interfaces \
    --network-interface-ids <eni-id> \
    --query 'NetworkInterfaces[0].PrivateIpAddress'
```

Create private DNS records that map your tenant hostname to these private IP addresses. The private IP addresses assigned to the endpoint's network interfaces are stable for the lifetime of the endpoint.

**Note**

AWS can assign different private IP addresses if you delete and recreate the endpoint. Update your DNS records after recreating the endpoint.

## Configure the Endpoint Security Group

The security group attached to the interface endpoint must allow inbound HTTPS traffic from clients that require access to Nexus Repository Cloud.

| Direction | Protocol | Port | Source |
|-----------|----------|------|--------|
| Inbound   | TCP      | 443  | Application CIDR ranges or security groups |

If the interface endpoint and the client resources share the same security group, add a self-referencing inbound rule for TCP port 443.

## Validate Connectivity

After creating the VPC endpoint, verify that traffic to your Sonatype tenant is routed through AWS PrivateLink and that DNS resolution returns private IP addresses.

### Verify DNS Resolution

Run the following commands from a host inside the VPC.

```
nslookup <your-tenant-url>
```

The hostname should resolve to private RFC1918 addresses such as:

```
10.x.x.x
172.x.x.x
192.168.x.x
```

### Verify HTTPS Connectivity

Run the following command to verify connectivity to Nexus Repository Cloud:

```
curl -o /dev/null -s -w "%{http_code}\n" \
    https://<your-tenant-url>/service/rest/v1/status/writable
```

Expected response:

```
200
```

### Complete the Cutover

After both validation checks succeed, notify your Sonatype contact.

Sonatype completes the cutover based on the selected access mode:

**Dual Access**

- Existing public clients continue to function.
- Clients inside the VPC automatically use PrivateLink.

**PrivateLink Only**

- Public access becomes unavailable.
- All clients must connect through PrivateLink.

Verify that all CI systems, build agents, and developer workflows can reach the tenant before requesting this mode.

## Verify Traffic Uses PrivateLink

Compare DNS resolution from inside and outside the VPC.

From inside the VPC:

```
nslookup <your-tenant-url>
```

Expected result

- Private IP addresses associated with the interface endpoint.

From outside the VPC:

```
nslookup <your-tenant-url>
```

Expected result:

- **Dual access**: Public IP addresses
- **PrivateLink only**: No DNS response or NXDOMAIN

You can also trace the network path:

```
traceroute -T -p 443 <your-tenant-url>
```

The trace should show a direct hop to the endpoint network interface rather than internet routing.

## Troubleshooting

#### [Connections Hang or Time Out](https://help.sonatype.com/en/aws-privatelink-for-nexus-repository-cloud.html#connections-hang-or-time-out_body)

Verify that the tenant hostname resolves to private IP addresses:

```
nslookup <your-tenant-url>
```

If the hostname resolves to public IP addresses:

- If you are using AWS-managed Private DNS, confirm the endpoint was created with `private-dns-enabled`. If you are using split-horizon DNS, verify your private DNS records are correct.
- Verify that no Route 53 private hosted zone overrides the tenant hostname.
- Confirm that VPC DNS support is enabled.

Verify the interface endpoint security group:

- Inbound TCP port 443 must be allowed from client resources.
- Client security groups and network ACLs must allow outbound TCP port 443.

#### [Availability Zone Not Supported](https://help.sonatype.com/en/aws-privatelink-for-nexus-repository-cloud.html#availability-zone-not-supported_body)

If endpoint creation fails with an Availability Zone error, verify that all selected subnets are in Availability Zones supported by the endpoint service.

Re-run:

```
aws ec2 describe-vpc-endpoint-services \
    --service-names <vpc_endpoint_service_name> \
    --query 'ServiceDetails[0].AvailabilityZones'
```

#### [HTTP 502 or 503 Responses](https://help.sonatype.com/en/aws-privatelink-for-nexus-repository-cloud.html#http-502-or-503-responses_body)

A 502 or 503 response indicates that connectivity to Nexus Repository Cloud succeeded but the service returned an error.

Retry the request. If the issue persists, contact Sonatype Support.

#### [HTTP 4xx Responses](https://help.sonatype.com/en/aws-privatelink-for-nexus-repository-cloud.html#http-4xx-responses_body)

A 4xx response indicates that Nexus Repository Cloud received and processed the request.

Review:
- Authentication credentials.
- Repository permissions.
- Request URLs.
- Access policies.

#### [Private DNS Resolves to Public Addresses](https://help.sonatype.com/en/aws-privatelink-for-nexus-repository-cloud.html#private-dns-resolves-to-public-addresses_body)

**AWS Managed Private DNS**

- `PrivateDnsEnabled` is set to `true`.
- `enableDnsSupport` is enabled.
- `enableDnsHostnames` is enabled.
- No Route 53 private hosted zone overrides the tenant hostname.

**Split-Horizon DNS**

- The private DNS zone is associated with the correct VPC.
- DNS records point to the current endpoint network interface IP addresses.
- Clients use the private DNS resolver rather than a public resolver.