Skip to main content

AWS PrivateLink Setup (For Business Critical Accounts)

Complete your Yuki Proxy deployment first (via Fully Hosted, Helm, or Terraform). Use this guide after the proxy is connected if your organization requires that all Yuki–Snowflake communication stays within AWS private networking.

Deployment Architecture Overview​

All PrivateLink configurations follow the same core principles: traffic flows privately between your environment, the Yuki Proxy, and Snowflake - without traversing the public internet.

Your existing environment:

Your existing environment

With Yuki - Full Hosted (SaaS):

With Yuki - Full Hosted SaaS PrivateLink

With Yuki - Same Cluster:

With Yuki - Same Cluster PrivateLink

With Yuki - Dedicated VPC:

With Yuki - Dedicated VPC PrivateLink

Requirements​

  • Snowflake Business Critical edition or higher
  • Your Snowflake account and the PrivateLink endpoints must be in the same AWS region
  1. Ask Snowflake Support to enable AWS PrivateLink on your account, providing Yuki's AWS Account ID and your Snowflake account identifier
  2. Run in Snowflake: 
    SELECT SYSTEM$GET_PRIVATELINK_CONFIG();
  3. Share the full JSON output securely with Yuki Support
  4. Yuki establishes a PrivateLink interface endpoint and validates connectivity
  5. Yuki provides the PrivateLink host address
  6. In Yuki, update the Snowflake connection to use the PrivateLink host

Connectivity from Your AWS VPC to Yuki​

Prerequisites​

  • An existing VPC
  • Two private subnets across different availability zones
  • A security group allowing inbound TCP 443
  • VPC DNS hostnames enabled

Steps​

  1. Contact Yuki Support for PrivateLink enablement (provide your AWS account ID)
  2. Create a VPC Interface Endpoint with private DNS enabled
  3. Request Yuki approval for the endpoint connection