Skip to content
Astrato

Private networking on AWS

4 min read · Updated 9 Nov 2026

If your database sits in a private AWS network with no public address, Astrato can reach it over a private path instead of the public internet. There are two ways to set one up, and each needs work on both sides: you configure your AWS account, then Astrato configures its side.

  • AWS PrivateLink: you expose one service, such as a database, as a VPC endpoint service, and Astrato connects to that endpoint. Astrato sees only that service.
  • AWS Transit Gateway: you share a transit gateway with Astrato’s AWS account, which joins the two networks. Astrato can reach the address ranges and ports you open to it.

If your database has a public address, you do not need either: allow Astrato’s addresses instead, as described in Allow Astrato’s addresses.

The steps below happen in the AWS console, so they link AWS’s own documentation for each screen.

Section titled “AWS PrivateLink”

In PrivateLink terms, Astrato is the service consumer and your AWS account is the service provider.

What you need first:

  • An AWS account that hosts the database, in a region Astrato supports for PrivateLink. Ask your Astrato account executive which regions those are.
  • Astrato’s AWS principal, from your Astrato account executive.

Set it up in AWS:

  1. Create a Network Load Balancer that targets the service to expose, such as the database. See Create a Network Load Balancer.
  2. Create a VPC endpoint service on that load balancer. See Create an endpoint service.
  3. Allow Astrato’s principal to connect to the endpoint service. See Manage permissions.
  4. If the endpoint service requires acceptance, accept Astrato’s connection request once Astrato has created its endpoint, or turn acceptance off for the service. Until then the endpoint stays pending and cannot carry traffic. See Accept or reject connection requests.

Send Astrato:

  • The VPC endpoint service name.
  • The AWS region the endpoint service is in.

AWS Transit Gateway

Section titled “AWS Transit Gateway”

What you need first:

  • The VPC that holds the database.
  • Astrato’s AWS account ID, from your Astrato account executive or Astrato support.
  • The address ranges of Astrato’s VPC, also from Astrato, so you can allow them. Check that they do not overlap your database VPC’s ranges: a transit gateway does not propagate routes for overlapping ranges. If they overlap, ask Astrato about another approach before you start.

Set it up in AWS:

  1. In the Amazon VPC console, choose the region of your VPC and create a transit gateway. Give it a name and description, and turn on DNS support, VPN ECMP support, Default route table association and Default route table propagation. Leave Transit gateway CIDR blocks empty unless your network needs specific ranges. See Transit gateways.
  2. Create a transit gateway attachment of type VPC for that gateway. Turn on DNS support and Security Group Referencing support, then choose the VPC and the subnets to attach. Choose a subnet in every Availability Zone where the database runs, including its standby or replicas: traffic reaches a database only through an attachment subnet in its own Availability Zone, so a missing zone breaks the connection, for example after a failover.
  3. Share the transit gateway with Astrato through AWS Resource Access Manager: from the transit gateway’s Actions menu, choose Share transit gateway and create a resource share. Set managed permissions that meet your organization’s security requirements, and add Astrato’s AWS account ID as the principal. See Create a resource share.
  4. Allow connections from Astrato’s VPC address ranges to the database, on the ports it listens on.
  5. In the route table of the database’s subnets, add a route to Astrato’s VPC address ranges through the transit gateway, so replies can reach Astrato. See Transit gateway attachments to a VPC.
  6. Once Astrato has attached its VPC to the shared transit gateway, accept that attachment if Auto accept shared attachments is off for the gateway. A pending attachment carries no traffic. See Accept a shared attachment.

Send Astrato:

  • IP ranges: where Astrato needs to connect.
  • Ports: the ports the service listens on.
  • Service connection URL: the address Astrato uses to test the network path. If its name resolves only in a Route 53 private hosted zone, Astrato cannot resolve it through the transit gateway alone; say so, or send an IP address instead.

What next

Section titled “What next”

When Astrato confirms that its side is in place, create the connection in Astrato as usual: