Applicability

Description

Private Connectivity: Splunk Cloud private connectivity allows you to directly connect your Splunk Cloud Platform environment with your Amazon Virtual Private Cloud (VPC). This allows you to route the data you ingest into the Splunk Cloud Platform through the Amazon Web Service (AWS) internal network using AWS PrivateLink. Although AWS-to-AWS traffic should not leave the global AWS network (with a minor documented exception), the PrivateLink feature ensures your AWS traffic sent to the Splunk Cloud Platform only traverses private IPs (in other words, non-public internet routable addresses).

According to this Document, Private Connectivity enables our users in regulated environments with an AWS presence to send data (Forwarder and HEC traffic) to their Splunk Cloud stack over private endpoints, without ever exposing it over the public internet.
Starting today, private connectivity is available as an opt-in connectivity option with PCI, HIPAA, IRAP, and FedRAMP Moderate subscriptions at no additional cost*.

What is AWS PrivateLink?

AWS PrivateLink provides secure, private connectivity between Amazon VPCs, AWS services, and on-premises applications on the AWS network. As a result,  it can simply and securely access services on AWS using the private Amazon network, powering connectivity to AWS services through the interface Amazon VPC endpoints.
 

Investigation

Based on our available documentation it provides the following considerations before enabling the Private Connectivity feature:

• Ingest Data sent to Splunk Cloud Platform from Universal forwarders, Heavy forwards or HEC endpoint & incoming Search, API and UI access traffic can be enabled to flow over AWS Private link
• All other Splunk Cloud Platform data will flow over the public internet. 
• You have the flexibility to only choose endpoints that need to traverse via private connectivity – Data Ingest only Search tier only, or both
• Data that you send to the Splunk Cloud Platform must originate from the same region as your Splunk Cloud environment.
• To connect multiple AWS accounts through private connectivity, you need to create a VPC and Private Link endpoint for each account.
• You are responsible for AWS costs associated with your VPC.

To leverage private connectivity for your Splunk Cloud Platform deployment you need to meet below requirement:

•  must be using AWS infrastructure.
•  must be on the Victoria Experience for AWS standard regions or the Classic Experience for USGov and FedRAMP Moderate regions.
•  the  deployment must have one or more separate search heads or a search head cluster. Private connectivity requires ACS and ACS is not supported on single instance deployments.
• must have sc_admin role for the ACS API.

Using this Document Check if the Private Connectivity is enabled.

Splunk Cloud private connectivity supports the additional needs of users who operate in one of the following regulated environments:

• Health Insurance Portability and Accountability Act (HIPAA)
• Payment Card Industry Data Security Standard (PCI DSS)
• Infosec Registered Assessors Program (IRAP)
• Federal Risk and Authorization Management Program Impact Level 2 (FedRAMP IL2)

Environments that don't comply with the above-mentioned will not be eligible for the private connectivity feature.
As of now, there is no ongoing development to provide this feature for non-regulated environments.

Resolution

If Splunk endpoints are in central regions and they need to have VPC peering for EAST or WEST or NORTH regions they need to set up the dummy VPC in the environment (same region as their Splunk Cloud stack) and route all Splunk data via the new VPC.

The configuration that they should modulate is Inter-Region access to endpoint services 

Related Links

Private Connectivity 
Enable Private Connectivity
Securely Access Services Over AWS PrivateLink 
Centralized Access to VPC Private Endpoints
AWS PrivateLink Support on Splunk Cloud Platform