# AWS PrivateLink

You can connect to the Checkout.com APIs privately with AWS PrivateLink to improve data security.

AWS PrivateLink enables you to create and establish connections between virtual private clouds (VPCs).

To communicate with the Checkout.com APIs, create a VPC endpoint in your service consumer VPC and connect it to the Checkout.com service provider VPC.

---

## Connection regions

AWS PrivateLink connections are only possible between subsets of AWS regions. Cross-regional connectivity is available in:

- Asia Pacific (Hyderabad)
- Asia Pacific (Jakarta)
- Asia Pacific (Melbourne)
- Asia Pacific (Singapore)
- Asia Pacific (Sydney)
- Asia Pacific (Tokyo)
- Canada West (Calgary)
- Europe (Ireland)
- Europe (Zurich)
- Middle East (UAE)
- South America (São Paulo)
- US East (Northern Virginia)
- US West (Oregon)

---

## Base URLs

AWS PrivateLink connections use the following base URLs, depending on which environment you want to perform the API call in:

- Live – `https://pl-{prefix}.api.checkout.com/{path}`
- Test – `https://pl-{prefix}.api.sandbox.checkout.com/{path}`

The `{prefix}` value in the base URL is a string containing the first eight characters of your unique `client_id`, excluding the `cli_` prefix. For example, if your client ID is `cli_vkuhvk4vjn2edkps7dfsq6emqm`, the base URL for your production environment is:

`https://pl-vkuhvk4v.api.checkout.com/{path}`

The `{path}` value in the URL represents the resource from the [API](https://api-reference.checkout.com/). For example, `payments/{id}`.

### Supported domains

You can only connect to the `api.checkout.com` domain with AWS PrivateLink. Traffic to all other Checkout.com domains uses public DNS resolution and is routed to Checkout.com via the internet.

If you require all traffic to pass through AWS PrivateLink, you can override the public DNS name.

> **Note**
>
> Overrides take effect immediately. Do not use them if you need to control the roll out at an application level.

---

## Configure the VPC endpoint

Before you configure the VPC endpoint, you must:

1. Set `enableDnsHostnames` and `enableDnsSupport` to `true` in the VPC that establishes a VPC endpoint connection to the Checkout.com VPC service endpoint.
2. Contact your Checkout.com solutions engineer or account manager and provide them with your AWS account ID. We add your ID to our allowlist.

Once you've done this, you can configure your VPC endpoint:

1. Sign in to the AWS Console.
2. Go to the VPC dashboard.
3. Select _Endpoints_ > _Create endpoint_.
4. In the _Service category_ section, select _Other endpoint services_.
5. In _Service settings_, add the following service names to each environment:
  - Production environment – `com.amazonaws.vpce.eu-west-1.vpce-svc-0952fdb05548049fb`
  - Sandbox environment – `com.amazonaws.vpce.eu-west-1.vpce-svc-0d45d28a6d943b992`
6. Select _Verify service_. This step only works if you've provided Checkout.com with your AWS account ID and we've added it to our allowlist.
7. Select the VPC you want the endpoint to be created in.
8. Copy the endpoint ID. You need this value when you [configure the Route 53 hosted zone](#Configure_the_Route_53_private_hosted_zone).

> **Information**
>
> Your new endpoint appears in the _VPC endpoints_ page with _Available_ status. When Checkout.com accepts the connection, the status updates.

---

## Configure the Route 53 private hosted zone

1. Sign in to the AWS Console.
2. Go to the _Route 53 Services_ page and select _Create hosted zone_.
3. In the _Domain name_ field, enter your unique base URL. For example, `https://pl-vkuhvk4v.api.checkout.com`.
4. Associate the hosted zone to the VPC you want to enable AWS PrivateLink connectivity for.
5. In your new hosted zone, create a new record.
6. Leave the _Record name_ field empty.
7. Set the _Record type_ to _A - Routes traffic to an IPv4 address and some AWS resources_.
9. Set the _Route traffic to_ field to _Alias to VPC endpoint_.
9. Set the endpoint to the [VPC endpoint you configured](#Configure_the_VPC_endpoint). Ensure you select the endpoint that does not contain a region within the ID. For example, `eu-west`.
10. Select the _Simple routing_ policy.
11. Enable _Evaluate target health_.
12. Select _Create records_.

---

## Update service applications

To route requests via the new domain name, you must update your service applications:

- If you integrate using a Checkout.com SDK, update the environment subdomain to your unique DNS name. For example, `pl-vkuhvk4v`.
- If you use another method to integrate, update all instances of the `api.checkout.com` domain to your unique AWS PrivateLink domain. For example `https://pl-vkuhvk4v.api.checkout.com`.

> **Information**
>
> We recommend that you test the connection before you roll out the change to your production environment.