# Terraform add-on: PrivateLink

Generated reference for the PrivateLink add-on module.

### Requirements

| Name | Version |
| ---- | ------- |
| terraform | >= 1.14 |
| aws | ~> 6.0 |

### Providers

| Name | Version |
| ---- | ------- |
| aws.consumer | 6.54.0 |
| aws.provider | 6.54.0 |

### Resources

| Name | Type |
| ---- | ---- |
| [aws\_vpc\_endpoint.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
| [aws\_vpc\_endpoint\_service.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint_service) | resource |

### Inputs

| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| consumer\_side | Consumer side — the AWS account that's dialing into the endpoint (typically a spoke for NATS, or the hub for a spoke's KS/POL). The Endpoint is created in the consumer's VPC; routes propagate via the chosen subnets' route tables. Set `service_region` to the PROVIDER's region for a cross-region PrivateLink (e.g. hub in us-east-1 consuming a shard's endpoint service in us-west-2); leave null for same-region. | <pre>object(\{<br />    vpc\_id              = string<br />    subnet\_ids          = list(string)<br />    security\_group\_ids  = list(string)<br />    private\_dns\_enabled = optional(bool, false)<br />    service\_region      = optional(string, null)<br />  })</pre> | n/a | yes |
| name | Name prefix for the PrivateLink resources (e.g. "crypto-vault-nats-hub-to-spoke-0"). | `string` | n/a | yes |
| provider\_side | Provider side of the PrivateLink — the AWS account that hosts the backing NLB (typically the hub cluster for NATS, or a spoke for its KS/POL). The NLB ARN is the one the AWS Load Balancer Controller provisioned for the chart's internal-LB Service; pass it explicitly so this module isn't coupled to how the NLB is discovered. `supported_regions` enables cross-region consumers — set it to the list of consumer regions (including the provider's own region) when the consumer endpoint lives in a different region; leave null for same-region. | <pre>object(\{<br />    nlb\_arn                      = string<br />    allowed\_consumer\_account\_ids = list(string)<br />    acceptance\_required          = optional(bool, false)<br />    supported\_ip\_address\_types   = optional(list(string), \["ipv4"])<br />    supported\_regions            = optional(list(string), null)<br />    # One NLB backs at most one endpoint service. For a second+ consumer of<br />    # the same NLB, set this false and pass `existing_service_name`.<br />    create\_endpoint\_service = optional(bool, true)<br />    existing\_service\_name   = optional(string, null)<br />  })</pre> | n/a | yes |
| tags | Extra tags merged onto every resource. | `map(string)` | `{}` | no |

### Outputs

| Name | Description |
| ---- | ----------- |
| endpoint\_dns\_entries | Raw DNS name(s) of the consumer-side Endpoint ENIs (one regional record + one zonal record per AZ, in AWS-defined order). For building a service URL prefer `regional_dns_name` — the order of this list is NOT guaranteed, so `[0]` may be a zonal (single-AZ) record. If `private_dns_enabled = true`, publish the service's own private DNS instead. |
| endpoint\_id | ID of the consumer-side VPC Endpoint. |
| endpoint\_service\_name | AWS service name of the Endpoint Service on the provider side. Pass this as `provider_side.existing_service_name` to a second module invocation that adds another consumer endpoint to the same NLB. Falls back to the existing name when this invocation didn't create the service. |
| regional\_dns\_name | The regional (cross-AZ) DNS name of the consumer-side Interface Endpoint — use this to build service URLs (e.g. nats://\<regional\_dns\_name>:4222, http://\<regional\_dns\_name>:80). An Interface endpoint exposes one regional record (vpce-\<id>.vpce-svc-\<svc>.\<region>.vpce.amazonaws.com) plus one zonal record per AZ (vpce-\<id>-\<az>.vpce-svc-...); the zonal records are the regional name with an AZ label prepended, hence strictly longer. We pick the shortest dns\_name, which is the regional record regardless of list ordering or AZ-ID format. Resolves to a healthy ENI in any AZ, preserving cross-AZ failover. |