// Module included in the following assemblies:
//
// * rosa_install_access_delete_clusters/rosa-aws-privatelink-creating-cluster.adoc
// * rosa_hcp/rosa-hcp-aws-private-creating-cluster.adoc
ifeval::["{context}" == "rosa-hcp-aws-private-creating-cluster"]
:rosa-hcp:
endif::[]
ifeval::["{context}" == "rosa-aws-privatelink-creating-cluster"]
:rosa-standalone:
endif::[]
:_mod-docs-content-type: REFERENCE
[id="osd-aws-privatelink-required-resources_{context}"]
= Requirements for using AWS PrivateLink clusters

[role="_abstract"]
AWS PrivateLink clusters require specific AWS resources including VPC, private subnets, and network access controls.

ifdef::rosa-hcp[]
For {hcp-title} private clusters, internet gateways, NAT gateways, and public subnets are not required, but the private subnets must have internet connectivity to install the required components. At least one private subnet is required. The following table shows the AWS resources that are required for a successful installation:
endif::rosa-hcp[]
ifndef::rosa-hcp[]
For AWS PrivateLink clusters, internet gateways, NAT gateways, and public subnets are not required, but the private subnets must have internet connectivity provided to install required components. At least one single private subnet is required for Single-AZ clusters and at least 3 private subnets are required for Multi-AZ clusters. The following table shows the AWS resources that are required for a successful installation:
endif::rosa-hcp[]

.Required AWS resources
[cols="1a,2a,3a",options="header"]
|===
| Component | AWS Type | Description
| VPC
|* AWS::EC2::VPC
* AWS::EC2::VPCEndpoint
| You must provide a VPC for the cluster to use.

| Network access control
|* AWS::EC2::NetworkAcl
* AWS::EC2::NetworkAclEntry
|
You must allow access to the following ports:
[cols="35%,65%",options="header"]
!===
!Port !Reason
! 80
! Inbound HTTP traffic
! 443
! Inbound HTTPS traffic
! 22
! Inbound SSH traffic
! 1024-65535
! Inbound ephemeral traffic
! 0-65535
! Outbound ephemeral traffic
!===

| Private subnets
|* AWS::EC2::Subnet
* AWS::EC2::RouteTable
* AWS::EC2::SubnetRouteTableAssociation
|
ifdef::rosa-hcp[]
Your VPC must have private subnets in at least 1 availability zone.
endif::rosa-hcp[]
ifndef::rosa-hcp[]
Your VPC must have private subnets in 1 availability zone for Single-AZ deployments or 3 availability zones for Multi-AZ deployments.
endif::rosa-hcp[]
You must provide appropriate routes and route tables.
|===
ifeval::["{context}" == "rosa-hcp-aws-private-creating-cluster"]
:!rosa-hcp:
endif::[]
ifeval::["{context}" == "rosa-aws-privatelink-creating-cluster"]
:!rosa-standalone:
endif::[]