Amazon DocumentDB API and interface VPC endpoints (Amazon PrivateLink)

You can establish a private connection between your VPC and Amazon DocumentDB API endpoints by creating an interface VPC endpoint. Interface endpoints are powered by Amazon PrivateLink.

While Amazon DocumentDB instance-based clusters do not require an interface VPC endpoint connection, Amazon PrivateLink enables you to privately access Amazon DocumentDB API operations without an internet gateway, NAT device, VPN connection, or Amazon Direct Connect connection. Amazon DocumentDB instances in your VPC don't need public IP addresses to communicate with Amazon DocumentDB API endpoints to launch, modify, or terminate database instances and database clusters. Your Amazon DocumentDB instances also don't need public IP addresses to use any of the available Amazon DocumentDB API operations. Traffic between your VPC and Amazon DocumentDB doesn't leave the Amazon network.

Each interface endpoint is represented by one or more elastic network interfaces in your subnets. For more information, see Elastic network interfaces in the Amazon EC2 User Guide.

For more information about VPC endpoints, see Access an Amazon Web Services service using an interface VPC endpoint in the Amazon Virtual Private Cloud (Amazon PrivateLink) User Guide. For more information about Amazon DocumentDB operations, see the Amazon DocumentDB cluster, instance, and resource management API reference.

Considerations for VPC endpoints

Before you set up an interface VPC endpoint for Amazon DocumentDB API endpoints, ensure that you review the interface endpoint prerequisites in the Amazon Virtual Private Cloud (Amazon PrivateLink) User Guide.

All Amazon DocumentDB API operations relevant to managing Amazon DocumentDB resources are available from your VPC using Amazon PrivateLink.

VPC endpoint policies are supported for Amazon DocumentDB API endpoints. By default, full access to Amazon DocumentDB API operations is allowed through the endpoint. For more information, see Control access to VPC endpoints using endpoint policies in the Amazon Virtual Private Cloud (Amazon PrivateLink) User Guide.

Region availability

Amazon DocumentDB API currently supports VPC endpoints in the following Amazon Web Services Regions:

Creating an interface VPC endpoint for Amazon DocumentDB API

You can create a VPC endpoint for the Amazon DocumentDB API using either the Amazon VPC Console or the Amazon Command Line Interface (Amazon CLI). For more information, see Access an Amazon Web Services service using an interface VPC endpoint in the Amazon Virtual Private Cloud (Amazon PrivateLink) User Guide.

Create a VPC endpoint for the Amazon DocumentDB API using the service name com.amazonaws.region.rds.

Excluding Amazon Web Services Regions in China, if you enable private DNS for the endpoint, you can make API requests to Amazon DocumentDB with the VPC endpoint using its default DNS name for the Amazon Web Services Regions, for example rds.us-east-1.amazonaws.com. For the China (Beijing) and China (Ningxia) Amazon Web Services Regions, you can make API requests with the VPC endpoint using rds-api.cn-north-1.amazonaws.com.cn and rds-api.cn-northwest-1.amazonaws.com.cn, respectively.

For more information, see Access an Amazon Web Services service using an interface VPC endpoint in the Amazon Virtual Private Cloud (Amazon PrivateLink) User Guide.

Creating a VPC endpoint policy for Amazon DocumentDB API

You can attach an endpoint policy to your VPC endpoint that controls access to the Amazon DocumentDB API. The policy specifies the following information:

For more information, see Control access to VPC endpoints using endpoint policies in the Amazon Virtual Private Cloud (Amazon PrivateLink) User Guide.

Example: VPC endpoint policy for Amazon DocumentDB API actions

The following is an example of an endpoint policy for Amazon DocumentDB API. When attached to an endpoint, this policy grants access to the listed Amazon DocumentDB API actions for all principals on all resources.

{
"Statement":[
      {
         "Principal":"*",
         "Effect":"Allow",
         "Action":[
            "docdb:CreateDBInstance",
            "docdb:ModifyDBInstance",
            "docdb:CreateDBSnapshot"
         ],
         "Resource":"*"
      }
   ]
}

Example: VPC endpoint policy that denies all access from a specified Amazon account

The following VPC endpoint policy denies Amazon account 123456789012 all access to resources using the endpoint. The policy allows all actions from other accounts.

{
  "Statement": [
    {
      "Action": "*",
      "Effect": "Allow",
      "Resource": "*",
      "Principal": "*"
    },
    {
      "Action": "*",
      "Effect": "Deny",
      "Resource": "*",
      "Principal": { "Amazon": [ "123456789012" ] }
     }
   ]
}