Private Link lets your cloud environment connect to Cribl-managed resources over your cloud provider’s private network, so data does not traverse the public internet. In Cribl.Cloud, you can enable Private Link for:

• Cribl-managed Stream Worker Groups, so your Sources send data to a Worker Group over a private connection.
• The Cribl.Cloud Leader, so your customer-managed hybrid Workers, Outposts, and connected environments communicate with the Leader over a private connection.

Cribl.Cloud supports AWS PrivateLink and Azure Private Link for Worker Groups. Leader connectivity is supported on AWS only.

Private Link secures the data that Sources push to Stream Worker Groups and the communication between hybrid Workers and the Leader. It does not apply to Collector or other pull-based Sources, to data that Cribl sends to Destinations, or to Cribl Lake or Cribl Search as products. You enable Private Link only on provisioned, cloud-hosted Stream Worker Groups and on the Leader.

Edge Fleets are not Private Link resources that you enable in Cribl.Cloud. Edge Nodes that run in a VPC or VNet with a private endpoint can still use Private Link. Point those Nodes at the private hostname for the Leader or for a Stream Worker Group, the same way you would for hybrid Workers and other clients.

Cribl Search provides its own Private Link connectivity for querying Azure Blob Storage. For that use case, see Configure Private Link in the Cribl Search documentation.

Private Link Compared to Static IP Allowlisting ​

Private Link and static IP allowlisting are separate network-access models. Which one is available depends on the Cribl service and cloud provider. They are not combined on the same connection path.

With static IP allowlisting, Cribl provides a fixed set of IP addresses that you allow in your firewall or security group. Traffic still crosses the public internet, filtered by source address. With Private Link, traffic stays on your cloud provider’s private network and never reaches the public internet.

Cribl recommends Private Link over static IP allowlisting for these reasons:

• Tighter scope: A private connection targets only the specific Worker Group or Leader service you connect to, rather than opening your firewall to a range of Cribl IP addresses.
• You stay in control: The connection does not become active until you create the endpoint in your own cloud account.
• No public-internet exposure: Traffic travels over the cloud provider’s private network rather than the public internet.
• Less operational overhead: You do not need to track or update IP allowlists as underlying infrastructure changes.

If you use static IP allowlisting for Leader connectivity, you can find your Cribl.Cloud Leader’s static IPs in Workspace > Access > Leader NLB IPs. See Configuration Considerations.

Availability and Eligibility ​

Private Link for Cribl.Cloud is available to eligible Organizations on the Enterprise tier in Cribl.Cloud Commercial.

Eligibility is tied to your Organization’s pricing tier. If your Organization is eligible, users with the Admin permission can configure Private Link from the Cribl.Cloud portal. If your Organization is not eligible, Cribl does not display Private Link setup actions. To enable Private Link for your Organization, contact your Cribl account team.

By default, each Workspace can have up to 10 Private Link-enabled services. This count includes the Leader and each Worker Group that has Private Link enabled. Cribl can adjust this limit for your Organization on request.

Prerequisites ​

Before you begin, make sure you have:

• An eligible Organization and the Admin permission. See Availability and Eligibility.
• A provisioned, cloud-hosted Stream Worker Group (AWS or Azure), or the Workspace Leader (AWS), to enable Private Link on. See Enable Private Link for a Worker Group and Enable Private Link for the Leader.
• A VPC or VNet in the same cloud provider as the Cribl-managed resource. Private Link connects resources within a single cloud provider and does not connect across cloud providers. On AWS, create the VPC in the same region as the resource. On Azure, the VNet can be in a different region, because Azure Private Link supports cross-region connections by default. See Create the Connection in Your Cloud Account.
• For AWS: the IAM principal ARNs that you want to allow to connect. Wildcards are not accepted.
• For Azure: the subscription IDs that you want to allow to connect.

Set Up Private Link ​

Configure Private Link in the Cribl.Cloud portal. Open Connections, then select the Private Links tab. That tab lists the Leader and each eligible Stream Worker Group.

Enable Private Link for a Worker Group ​

1. In the Cribl.Cloud portal, select Connections, then select the Private Links tab.

2. In the Private Links table, select the Stream Worker Group. The Worker Group must be provisioned. If it is not, provision it first.

3. Toggle Enable private link on.

4. Add the entities that are allowed to connect. Enter one per line, or separate them with commas:

   • On AWS Worker Groups, add the AWS IAM principal ARNs. Wildcards are not accepted.
   • On Azure Worker Groups, add the Azure subscription IDs. Listed subscription IDs can discover the service and are auto-approved when they create a Private Endpoint.

5. Save your changes. Provisioning begins, and the status is Pending until the service is ready. Provisioning typically takes 20 to 30 minutes.

Enable Private Link for the Leader ​

Leader Private Link is supported on AWS only. The Leader connection is the Workspace Leader connection. These are not separate Private Link resources.

1. In the Cribl.Cloud portal, select Connections, then select the Private Links tab.
2. In the Private Links table, select the Workspace/Leader resource.
3. Toggle Enable private link on.
4. Add the AWS IAM principal ARNs that are allowed to connect.
5. Save your changes. Provisioning begins, and the status is Pending until the service is ready.

Save Your Configuration and Provisioning ​

Cribl.Cloud validates the entries as you add them. Save stays unavailable until the Worker Group is provisioned, you have unsaved changes, and every entry is a valid IAM principal ARN (AWS) or subscription ID (Azure). When you save, Cribl.Cloud confirms the change and returns you to the Private Links table.

Provisioning then begins, and the resource shows Pending until the service is ready, which typically takes 20 to 30 minutes. When the status is Enabled, the Private Links table shows the connection details for your cloud account: the private DNS name and the service name (AWS) or service alias (Azure).

Enabling Private Link in Cribl.Cloud alone does not route traffic privately. Next, create the endpoint in your cloud console, then point clients at the private path. See Create the Connection in Your Cloud Account and Route Traffic Over Private Link.

Disabling Private Link on a resource severs its active connections. If you re-enable Private Link later, you must re-create those connections in your cloud account. Changes to the allowlist can also take 20 to 30 minutes to reach the cloud provider.

Create the Connection in Your Cloud Account ​

After the status is Enabled, open the Private Links table and copy the values for that resource:

• AWS: Service Name (com.amazonaws.vpce.<region>.vpce-svc-...) and Private DNS Name.
• Azure: the service Alias.

Your IAM principal ARN (AWS) or subscription ID (Azure) must already be on the allowlist for that resource. Only listed principals or subscriptions can discover and connect. On Azure, listed subscription IDs also control auto-approval of Private Endpoint connections. Cribl accepts connections from allowlisted accounts automatically. You do not approve the connection in Cribl.

Private Link carries TCP only. UDP Sources, such as syslog on 514/UDP, do not work over Private Link. Use TCP-based Sources instead. Allow the TCP ports you need on the endpoint security group or network security group, and on any client-side firewalls. Worker Groups typically listen on TCP 443, a health probe on TCP 9000, and any custom ingest ports configured for the Worker Group. See Ports.

Then create the private endpoint in the same cloud provider as the Cribl-managed resource. On AWS, create it in the same region. On Azure, the endpoint can be in a different region.

AWS

1. Create an interface VPC endpoint to the Cribl endpoint service.
2. Paste the Service Name, verify the service, and select your VPC. Select a subnet in every Availability Zone that the service offers. Cribl does not expose which zones its Worker Group instances run in and distributes them across zones, so selecting fewer zones risks connecting to a zone with no Worker Group instances or reaching only a fraction of the Worker Group’s capacity. The endpoint creates a network interface in each zone you select.
3. Attach a security group that allows the TCP ports you need.
4. If verification fails, confirm that your principal ARN is on the Cribl allowlist.
5. Enable private DNS so the Cribl private DNS name resolves to the endpoint inside your VPC. Your VPC must have DNS resolution and DNS hostnames enabled. You can also enable or change private DNS later.

For AWS console steps, see Access SaaS products through AWS PrivateLink. To enable or change private DNS on the endpoint, see Configure an interface endpoint. For how Cribl associates the private DNS name with the endpoint service, see Manage DNS names for VPC endpoint services.

Azure

1. Create a private endpoint and choose Connect to an Azure resource by resource ID or alias.
2. Paste the Alias from Cribl.Cloud, then select the VNet and subnet for the endpoint.
3. Because your subscription is on Cribl’s allowlist, the connection should become Approved without a manual step on the Cribl side. If it stays Pending, confirm that your subscription ID is on the allowlist.

Azure does not publish a Cribl private DNS name, so you manage DNS on the consumer side. For how alias-based connections work, see What is a private endpoint?. For Azure portal steps, see Create a private endpoint. For DNS, see Azure Private Endpoint private DNS zone values.

Route Traffic Over Private Link ​

Setting up Private Link does not automatically move traffic onto the private path. After the endpoint exists in your account, update the hostnames that clients use.

• AWS with private DNS enabled: Use the private DNS name shown for the resource in the Private Links table. Cribl derives that name by inserting -private into the hostname. For a Worker Group, the pattern is <worker-group-id>-private.<workspace>.<organization>.<domain>. For the Leader, the pattern is leader-private.<workspace>.<organization>.<domain>. Point Sources, hybrid Workers, Outposts, connected environments, and Edge Nodes at that private hostname on the appropriate TCP port.
• AWS without private DNS: Create your own DNS in the VPC, for example with a Route 53 private hosted zone, and point a record at the endpoint. Target all of the endpoint’s zonal IP addresses, or alias the record to the regional endpoint DNS name that AWS shows for your endpoint in the console. Targeting every Availability Zone keeps the connection highly available. You can shadow the public Worker Group or Leader hostname so that name resolves to the private endpoint inside the VPC, which lets clients keep using the public address. Otherwise, use the private DNS pattern from the Private Links table.
• Azure: Create or reuse a private DNS zone, then link it to the VNet that holds the Private Endpoint. Add an A record that points at the Private Endpoint IP. Prefer the hostname pattern shown in the Private Links table (<worker-group-id>-private.<workspace>.<organization>.<domain>), or shadow the public Worker Group hostname so clients can keep using the public address. That name should match the TLS certificate clients expect. An arbitrary or unrelated domain name can cause TLS validation failures in some client software. Clients can use that hostname or the private IP.

Until clients resolve and use that private path, traffic continues over the public internet.

View Your Private Links ​

To review all of your Private Link resources, open the Cribl.Cloud portal, select Connections, then select the Private Links tab. The Private Links table lists every Private Link resource in the Workspace, including the Leader and each eligible Worker Group. Each row shows the Name, the Type (cloud provider), and the Enabled status. Each row also shows the number of allowed principals or subscriptions, the Private DNS name, and the Service Name/Alias.

To narrow the list, type in the filter box to match text in any column, or use the column filters on Name, Type, and Enabled status.

Private Link Statuses ​

The Private Links table shows the following statuses.

A Worker Group must be provisioned before you can enable Private Link on it. Until it is provisioned, the Enabled status for Private Link is blank, and the detail page for the Worker Group shows a warning with a Provision Now button. Provision the Worker Group first, then enable Private Link.

Provisioning typically takes 20 to 30 minutes. A resource remains Pending until provisioning completes.

Permissions and Access ​

• Users with the Admin permission can create, update, and validate Private Link configuration.
• Users without the required permission cannot create, update, or validate Private Link configuration, and see a read-only or restricted view.
• Ineligible Organizations do not see Private Link setup actions.

Troubleshooting ​

For more help, contact Cribl Support.

Limits and Notes ​

• By default, each Workspace can have up to 10 Private Link-enabled services, counting the Leader and each Worker Group. To request a higher limit, contact Cribl Support.
• Each Private Link service accepts up to 100 allowed principals (AWS) or subscription IDs (Azure).
• After you change the allowlist, the update can take 20 to 30 minutes to reach the cloud provider, the same as initial enablement.
• Disabling Private Link on a resource severs its active connections. If you re-enable Private Link later, you must re-create those connections in your cloud account.
• On AWS, create the endpoint in every Availability Zone that the service offers. Cribl does not expose which zones its Worker Group instances run in and distributes them across zones, so selecting fewer zones risks connecting to a zone with no Worker Group instances or reaching only a fraction of the Worker Group’s capacity. Azure private endpoints are highly available by default.
• Private Link connects resources within the same cloud provider. Cross-provider connections are not supported. On AWS, create the endpoint in the same region as the resource. Azure Private Link supports cross-region connections by default.
• Private Link carries TCP only. UDP is not supported over Private Link.
• Leader connectivity is supported on AWS only. The Leader and Workspace Private Link connection are the same resource.
• Private Link secures inbound data to Stream Worker Groups and hybrid Worker-to-Leader communication. It does not apply to Collector or other pull-based Sources, to data sent to Destinations, or to Cribl Lake or Cribl Search as products.
• Edge Fleets are not Private Link resources. Edge Nodes can use Private Link when they target the private hostname for the Leader or a Stream Worker Group from a network that reaches the private endpoint.