Private Link is the generic term used in this documentation. On Amazon Web
Services (AWS), the cloud provider’s feature is called AWS PrivateLink, and on
Microsoft Azure it’s called Azure Private Link.
What Private Link protects against
Private Link addresses two risks. Token exfiltration is when an attacker steals a valid token and replays it from outside your organization. Publicly accessible API endpoints expose the API to requests from anywhere on the internet. A Private Link-enabled project removes that exposure, because its API accepts only requests that arrive over Private Link. With Private Link, an attacker must both have a valid token for your CDF project and be able to send traffic from a private network tied to the CDF cluster via a private link endpoint. TLS encrypts traffic on both the Private Link path and the public path. Clients verify the CDF API’s TLS certificate as part of the TLS handshake. Client identity, authentication, and authorization aren’t altered by the use of Private Link. Users still sign in through your identity provider, and CDF still evaluates group-based capabilities on every request.How Private Link works
Private Link connects a provider and a consumer. The provider exposes its API through a Private Link service, and the consumer creates a private endpoint that connects to it. The provider has complete control over who can establish private endpoint connections. The endpoint is a network interface with a private IP address inside the consumer’s own virtual network. Traffic travels over the cloud provider’s backbone rather than public routes, and your own routing, network security groups, and firewalls govern who can reach the endpoint. For CDF, Cognite publishes the Private Link service and you create the private endpoint in your network. Operators, applications (including browser applications), and extractors reach the CDF API at that private address. For example, an extractor running in your network callshttps://pNNN.plink.<cluster>.cognitedata.com. The hostname resolves to a private address in your network, such as 10.0.1.25. The request reaches your private endpoint and travels over the cloud provider’s backbone to CDF, without using public routing at any point.
Private Link covers the API and data paths, and a Private Link-enabled CDF project rejects all traffic except Private Link traffic. CDF web applications load over the public internet, while the applications’ API calls go through the private endpoint.
Private Link is configured per CDF project, regardless of deployment model. For example, you can run production on Private Link and a test project on the public path. You can request Private Link for new CDF projects only. You can’t enable it on an existing project.
To protect your existing data and configuration with Private Link, request a new Private Link-enabled CDF project and migrate your data and configuration to it by using the CDF APIs or SDKs. You decide who does the migration: you, Cognite, or a third-party contractor.
Outbound integrations, for example MQTT and SAP writeback, are designed to keep their traffic on private paths. See Configure outbound AWS PrivateLink and Configure outbound Azure Private Link.
DNS
Each Private Link-enabled CDF project is addressed through a dedicated zone,*.plink.<cluster>.cognitedata.com. Because the zone is dedicated to Private Link, the same hostname never resolves to both a public and a private address, which avoids split-horizon DNS issues.
Cognite publishes the project’s DNS record in public DNS, using the details you provide during setup. Public DNS servers resolve the hostname to your private endpoint’s IP address, which is typically a private (RFC 1918) address. DNS resolution happens before any API request is sent. The request then travels over the cloud provider’s backbone to the private endpoint.
If your network filters outbound traffic, see Allowlist URLs for the domains to permit.
How a request is handled
The dedicated zone uses a wildcard TLS certificate. TLS encrypts the traffic, but a hostname header in an HTTPS request isn’t proof of where a request came from, even with mutual TLS (client certificate authentication). Anyone can send a request that names a Private Link hostname. As a result, CDF relies on the network path a request actually took. The following diagram shows two entry paths into a CDF cluster. Requests from your network arrive through the Private Link gateway and carry a Private Link indicator. Requests from the internet arrive through the internet-facing gateway, carry no indicator, and are rejected for Private Link-enabled projects.- A client in your network resolves the project’s hostname to the private endpoint and sends its request there.
- The request traverses the cloud provider’s backbone and enters the cluster through a dedicated Private Link gateway, which isn’t accessible from the internet.
- The gateway forwards the request to the authentication service, tagged as having arrived through Private Link.
- The authentication service first determines which CDF project the request is for and what that project’s rules are. A Private Link-enabled project requires that the request arrives through the Private Link path.
- Only after that check passes does CDF evaluate the token and the caller’s capabilities.
Security considerations
Private Link is one layer in the security of a CDF project. This section explains how Private Link limits risk, what it doesn’t change, and what remains your responsibility.How Private Link limits risk
The principal scenario, a stolen token replayed from the internet, is addressed by the source check described in How a request is handled. Cognite adds the following protections around that check.- An attacker forges headers to appear as Private Link traffic. CDF strips client-supplied equivalents of the Private Link indicator at ingress. Only Cognite’s gateway adds the indicator.
- An attacker uses HTTP request smuggling between ingress and authentication. CDF carries the whole request as data inside a gRPC envelope (a framed message in the gRPC protocol). CDF doesn’t parse the request in the client’s protocol.
- A service isn’t yet Private Link-aware. CDF fails closed, which means it denies access when it can’t confirm the request path. Such a service isn’t expected to work for a Private Link-enabled project.
Isolation between customers
Customers on the same multi-tenant cluster share the Private Link gateway. Private Link distinguishes Private Link traffic from internet traffic, but it doesn’t distinguish one customer’s private endpoint from another’s. Cognite provisions Private Link only through its onboarding process for contracted customers, and every request still needs a valid token and the right capabilities. For deeper isolation from other tenants, consider a dedicated CDF cluster or Cognite’s Private SaaS offering.Customer responsibilities
Private Link makes your network part of the trust boundary. Cognite secures the CDF side of the connection, and you secure access to the private endpoint through network security groups, firewall rules, segmentation, logging, and change control.Cross-project workflows
A workflow that reads from one project and writes to another could otherwise create an exfiltration path. CDF permits such a workflow, including transformations, only when both projects use the same path. The following table shows which combinations are permitted.Next steps
Follow the setup instructions for the cloud provider that hosts your CDF project: For related topics, see:- Configure outbound AWS PrivateLink and Configure outbound Azure Private Link for traffic from CDF to your systems.
- Private Link and Local Network Access browser permission for browser access to a Private Link-enabled project.
- Access management concepts for how organizations, projects, and identity providers fit together.
- Cognite security for Cognite’s broader security practices.