AWS private connectivity concerns

Applicability

Description

According to the documentation, The Splunk Cloud Private Connectivity allows direct connection to the Splunk Cloud deployment with your Amazon Virtual Private Cloud (VPC).
This allows you to route the data you ingest into the Splunk Cloud Platform through the Amazon Web Service (AWS) internal network using AWS PrivateLink. Although AWS-to-AWS traffic should not leave the global AWS network, the PrivateLink feature ensures the AWS traffic sent to the Splunk Cloud Platform only traverses private IPs (in other words, non-public internet routable addresses).

Investigation

The following considerations should be taken before enabling the Private Connectivity feature:
. Only ingest data that is sent to the Splunk Cloud Platform from a Universal Forwarder, Heavy Forwarder, or Http Event Collector (HEC) will flow over AWS Private Link.
. All other Splunk Cloud Platform data will flow over the public internet. This includes search, UI, and app data or services that require HEC acknowledgments (HEC w/ ACK). With that Firehose is not supported via Private Connectivity ingest.
. Data that is sent to the Splunk Cloud platform must originate from the same region as the Splunk Cloud deployment.
. To connect multiple AWS accounts through private connectivity, you need to create a VPC and Private Link endpoint for each account.
. You are responsible for AWS costs associated with your VPC.

Resolution

For those environments that are interested in acquiring the Private Connectivity feature, it is important to take into consideration the following:

. Private Connectivity is available only for regulated cloud environments (FedRAMP moderate, HIPAA, IRAP and PCI) on AWS regions. 

. Environments that don't comply with the above-mentioned will not be eligible for the private connectivity feature.

. As of now, there is no ongoing development to provide this feature for nonregulated environments. 

. HEC with ACK, Firehose, requires a special load balancer configuration which is not supported at this time with Private Connectivity. Firehose as a private link endpoint is not yet supported by AWS itself. there is no formal timeline commitments from AWS around it as of now.

Related Links

Networking/Security
About private connectivity
AWS Private Link Support on Splunk Cloud Platform