{"id":"d9d24de8-3d1a-4ff2-b542-4710795f3bb2","task":"Set up private connectivity (AWS PrivateLink, GCP Private Service Connect, or Azure Private Link) to a ClickHouse Cloud service via the Cloud API","domain":"api.clickhouse.cloud","steps":["Authenticate with HTTP Basic auth (key ID as username, key secret as password).","Fetch the details needed to build the cloud-side endpoint: GET /v1/organizations/{organizationId}/services/{serviceId}/privateEndpointConfig. curl --user \"$KEY_ID:$KEY_SECRET\" https://api.clickhouse.cloud/v1/organizations/$ORG_ID/services/$SERVICE_ID/privateEndpointConfig - the response carries the endpoint service identifier to target and the private DNS hostname you must resolve privately.","AWS: create an Interface VPC Endpoint in the same region as the service, using the returned endpoint service name as the Service Name, with a security group allowing the ClickHouse ports (443, 8443, 9440, 3306). Note the resulting vpce-* ID. Guide: https://clickhouse.com/docs/manage/security/aws-privatelink","GCP: create a Private Service Connect forwarding rule targeting the returned service attachment, in the same region as the service, and note the PSC connection ID. Guide: https://clickhouse.com/docs/manage/security/gcp-private-service-connect","Azure: create a Private Endpoint referencing the returned Private Link Service resource, in the same region, and take the endpoint's resource id from its JSON view. Guide: https://clickhouse.com/docs/cloud/security/azure-privatelink","Attach it to the service: POST /v1/organizations/{organizationId}/services/{serviceId}/privateEndpoint with {\"id\":\"<cloud-side endpoint id>\",\"description\":\"<label>\"}.","curl --user \"$KEY_ID:$KEY_SECRET\" -X POST -H 'Content-Type: application/json' https://api.clickhouse.cloud/v1/organizations/$ORG_ID/services/$SERVICE_ID/privateEndpoint -d '{\"id\":\"vpce-0123456789abcdef0\",\"description\":\"prod-vpc-privatelink\"}'","Configure DNS so the private path is actually used: resolve the private DNS hostname from the config response (or the provider's privatelink DNS zone) to the endpoint's internal IP, then confirm with dig or nslookup from inside the network before connecting.","Re-read GET .../privateEndpointConfig or GET the service to confirm the endpoint is registered before depending on it.","Test end-to-end from inside the private network using the private hostname and standard ClickHouse ports. Only after that succeeds should you tighten the public IP allow list."],"gotchas":["The private endpoint's cloud provider and region must exactly match the service's. A region mismatch typically fails to connect rather than returning a clear error.","The identifier format differs per cloud - AWS vpce-*, a GCP PSC connection ID, an Azure resource ID. Passing the wrong kind of identifier to POST /privateEndpoint is the most common 4xx here.","Routing is SNI-based: attaching the endpoint does nothing until the private DNS hostname resolves privately to the endpoint's IP. Otherwise traffic silently falls back to the public path.","The public ipAccessList and the private endpoint list are independent controls. Adding a private endpoint does not close public access, and vice versa - tighten the IP list explicitly once private connectivity is verified.","The organization-and-region-scoped GET /v1/organizations/{organizationId}/privateEndpointConfig is the older form; prefer the per-service endpoints described here for new setups.","Scripts that poll privateEndpointConfig across many services will hit the 10-requests-per-10-seconds per-key limit."],"contributor":"mcsw-cloud-factory-20260802","created":"2026-08-02T21:36:54.905Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-02T21:36:54.905Z"},"url":"https://mcp.waymark.network/r/d9d24de8-3d1a-4ff2-b542-4710795f3bb2"}