Private Link lets your cloud environment connect to Cribl-managed resources over your cloud provider’s private network, so data does not traverse the public internet. In Cribl.Cloud, you can enable Private Link for:

• Cribl-managed Stream Worker Groups, so your Sources send data to a Worker Group over a private connection.
• The Cribl.Cloud Leader, so your customer-managed hybrid Workers, Outposts, and connected environments communicate with the Leader over a private connection.

Cribl.Cloud supports AWS PrivateLink and Azure Private Link for Worker Groups. Leader connectivity is supported on AWS only.

Private Link secures the data that Sources push to Stream Worker Groups and the communication between hybrid Workers and the Leader. It does not apply to Collector or other pull-based Sources, to data that Cribl sends to Destinations, or to Cribl Lake or Cribl Search as products. You enable Private Link only on provisioned, cloud-hosted Stream Worker Groups and on the Leader.

Edge Fleets are not Private Link resources that you enable in Cribl.Cloud. Edge Nodes that run in a VPC or VNet with a private endpoint can still use Private Link. Point those Nodes at the private hostname for the Leader or for a Stream Worker Group, the same way you would for hybrid Workers and other clients.

Cribl Search provides its own Private Link connectivity for querying Azure Blob Storage. For that use case, see Configure Private Link in the Cribl Search documentation.

Private Link Compared to Static IP Allowlisting ​

Private Link and static IP allowlisting are separate network-access models. Which one is available depends on the Cribl service and cloud provider. They are not combined on the same connection path.

With static IP allowlisting, Cribl provides a fixed set of IP addresses that you allow in your firewall or security group. Traffic still crosses the public internet, filtered by source address. With Private Link, traffic stays on your cloud provider’s private network and never reaches the public internet.

Cribl recommends Private Link over static IP allowlisting for these reasons:

• Tighter scope: A private connection targets only the specific Worker Group or Leader service you connect to, rather than opening your firewall to a range of Cribl IP addresses.
• You stay in control: The connection does not become active until you create the endpoint in your own cloud account.
• No public-internet exposure: Traffic travels over the cloud provider’s private network rather than the public internet.
• Less operational overhead: You do not need to track or update IP allowlists as underlying infrastructure changes.

If you use static IP allowlisting for Leader connectivity, you can find your Cribl.Cloud Leader’s static IPs in Workspace > Access > Leader NLB IPs. See Configuration Considerations.

Availability and Eligibility ​

Private Link for Cribl.Cloud is available to eligible Organizations on the Enterprise tier in Cribl.Cloud Commercial.

Eligibility is tied to your Organization’s pricing tier. If your Organization is eligible, users with the Admin permission can configure Private Link from the Cribl.Cloud portal. If your Organization is not eligible, Cribl does not display Private Link setup actions. To enable Private Link for your Organization, contact your Cribl account team.

By default, each Workspace can have up to 10 Private Link-enabled services. This count includes the Leader and each Worker Group that has Private Link enabled. Cribl can adjust this limit for your Organization on request.

Prerequisites ​

Before you begin, make sure you have:

• An eligible Organization and the Admin permission. See Availability and Eligibility.
• A provisioned, cloud-hosted Stream Worker Group (AWS or Azure), or the Workspace Leader (AWS), to enable Private Link on. See Enable Private Link for a Worker Group and Enable Private Link for the Leader.
• A VPC or VNet in the same cloud provider and region as the Cribl-managed resource. Private Link connects resources within a single cloud provider and region, and does not connect across cloud providers or across regions. See Create the Connection in Your Cloud Account.
• For AWS: the IAM principal ARNs that you want to allow to connect. Wildcards are not accepted.
• For Azure: the subscription IDs that you want to allow to connect.

Set Up Private Link ​

Configure Private Link in the Cribl.Cloud portal. Open Connections, then select the Private Links tab. That tab lists the Leader and each eligible Stream Worker Group.

Enable Private Link for a Worker Group ​

1. In the Cribl.Cloud portal, select Connections, then select the Private Links tab.

2. In the Private Links table, select the Stream Worker Group. The Worker Group must be provisioned. If it is not, provision it first.

3. Toggle Enable private link on.

4. Add the entities that are allowed to connect. Enter one per line, or separate them with commas:

   • On AWS Worker Groups, add the AWS IAM principal ARNs. Wildcards are not accepted.
   • On Azure Worker Groups, add the Azure subscription IDs. Listed subscription IDs can discover the service and are auto-approved when they create a Private Endpoint.

5. Save your changes. Provisioning begins, and the status is Pending until the service is ready. Provisioning typically takes 20 to 30 minutes.

Enable Private Link for the Leader ​

Leader Private Link is supported on AWS only. The Leader connection is the Workspace Leader connection. These are not separate Private Link resources.

1. In the Cribl.Cloud portal, select Connections, then select the Private Links tab.
2. In the Private Links table, select the Workspace/Leader resource.
3. Toggle Enable private link on.
4. Add the AWS IAM principal ARNs that are allowed to connect.
5. Save your changes. Provisioning begins, and the status is Pending until the service is ready.

Confirmation and Completion Summary ​

After you submit a Private Link configuration, Cribl.Cloud validates your entries and asks you to confirm. When provisioning starts, a completion summary reports that Private Link is enabled and the resource is now Pending. When provisioning finishes and the status is Enabled, the summary shows the connection details for your cloud account. Those details are the private DNS name and the service name (AWS) or service alias (Azure).

Enabling Private Link in Cribl.Cloud alone does not route traffic privately. Next, create the endpoint in your cloud console, then point clients at the private path. See Create the Connection in Your Cloud Account and Route Traffic Over Private Link.

Create the Connection in Your Cloud Account ​

After the status is Enabled, open the Private Links table and copy the values for that resource:

• AWS: Service Name (com.amazonaws.vpce.<region>.vpce-svc-...) and Private DNS Name.
• Azure: the service Alias.

Your IAM principal ARN (AWS) or subscription ID (Azure) must already be on the allowlist for that resource. Only listed principals or subscriptions can discover and connect. On Azure, listed subscription IDs also control auto-approval of Private Endpoint connections. Cribl accepts connections from allowlisted accounts automatically. You do not approve the connection in Cribl.

Private Link carries TCP only. UDP Sources, such as syslog on 514/UDP, do not work over Private Link. Use TCP-based Sources instead. Allow the TCP ports you need on the endpoint security group or network security group, and on any client-side firewalls. Worker Groups typically listen on TCP 443, a health probe on TCP 9000, and any custom ingest ports configured for the Worker Group. See Ports.

Then create the private endpoint in the same cloud provider and region as the Cribl-managed resource.

AWS

1. Create an interface VPC endpoint to the Cribl endpoint service.
2. Paste the Service Name, verify the service, select your VPC and subnets, and attach a security group that allows the TCP ports you need.
3. If verification fails, confirm that your principal ARN is on the Cribl allowlist.
4. Enable private DNS so the Cribl private DNS name resolves to the endpoint inside your VPC. Your VPC must have DNS resolution and DNS hostnames enabled. You can also enable or change private DNS later.

For AWS console steps, see Access SaaS products through AWS PrivateLink. To enable or change private DNS on the endpoint, see Configure an interface endpoint. For how Cribl associates the private DNS name with the endpoint service, see Manage DNS names for VPC endpoint services.

Azure

1. Create a private endpoint and choose Connect to an Azure resource by resource ID or alias.
2. Paste the Alias from Cribl.Cloud, then select the VNet and subnet for the endpoint.
3. Because your subscription is on Cribl’s allowlist, the connection should become Approved without a manual step on the Cribl side. If it stays Pending, confirm that your subscription ID is on the allowlist.

Azure does not publish a Cribl private DNS name, so you manage DNS on the consumer side. For how alias-based connections work, see What is a private endpoint?. For Azure portal steps, see Create a private endpoint. For DNS, see Azure Private Endpoint private DNS zone values.

Route Traffic Over Private Link ​

Setting up Private Link does not automatically move traffic onto the private path. After the endpoint exists in your account, update the hostnames that clients use.

• AWS with private DNS enabled: Use the private DNS name shown for the resource in the Private Links table. Cribl derives that name by inserting -private into the hostname. For a Worker Group, the pattern is <worker-group-id>-private.<workspace>.<organization>.<domain>. For the Leader, the pattern is leader-private.<workspace>.<organization>.<domain>. Point Sources, hybrid Workers, Outposts, connected environments, and Edge Nodes at that private hostname on the appropriate TCP port.
• AWS without private DNS: Create your own DNS in the VPC, for example with a Route 53 private hosted zone, and point a record at the endpoint. You can shadow the public Worker Group or Leader hostname so that name resolves to the private endpoint inside the VPC. Clients can then keep using the public address. Otherwise use the private DNS pattern from the Private Links table.
• Azure: Create or reuse a private DNS zone, then link it to the VNet that holds the Private Endpoint. Add an A record that points at the Private Endpoint IP. Prefer the hostname pattern shown in the Private Links table (<worker-group-id>-private.<workspace>.<organization>.<domain>), or shadow the public Worker Group hostname so clients can keep using the public address. That name should match the TLS certificate clients expect. An arbitrary or unrelated domain name can cause TLS validation failures in some client software. Clients can use that hostname or the private IP.

Until clients resolve and use that private path, traffic continues over the public internet.

View Your Private Links ​

To review all of your Private Link resources, open the Cribl.Cloud portal, select Connections, then select the Private Links tab. The Private Links table lists every Private Link resource in the Workspace, including the Leader and each eligible Worker Group. For each resource, the table shows the resource type, cloud provider, enablement status, infrastructure status, and the allowed principals or subscription IDs. You can filter the table by Worker Group name, resource type, DNS name, and service name or alias.

Private Link Statuses ​

The Private Links table shows the following statuses.

Separately from the enablement status, the Private Links table has an Infrastructure column that shows whether the underlying resource is provisioned: Provisioned or None. Values that are not yet available appear as Not available.

Provisioning typically takes 20 to 30 minutes. A resource remains Pending until provisioning completes.

Permissions and Access ​

• Users with the Admin permission can create, update, and validate Private Link configuration.
• Users without the required permission cannot create, update, or validate Private Link configuration, and see a read-only or restricted view.
• Ineligible Organizations do not see Private Link setup actions.

Troubleshooting ​

For more help, contact Cribl Support.

Limits and Notes ​

• By default, each Workspace can have up to 10 Private Link-enabled services, counting the Leader and each Worker Group. To request a higher limit, contact Cribl Support.
• Each Private Link service accepts up to 100 allowed principals (AWS) or subscription IDs (Azure).
• Private Link connects resources within the same cloud provider and region. Cross-provider and cross-region connections are not supported.
• Private Link carries TCP only. UDP is not supported over Private Link.
• Leader connectivity is supported on AWS only. The Leader and Workspace Private Link connection are the same resource.
• Private Link secures inbound data to Stream Worker Groups and hybrid Worker-to-Leader communication. It does not apply to Collector or other pull-based Sources, to data sent to Destinations, or to Cribl Lake or Cribl Search as products.
• Edge Fleets are not Private Link resources. Edge Nodes can use Private Link when they target the private hostname for the Leader or a Stream Worker Group from a network that reaches the private endpoint.