# VPC Private Endpoint
![`smart`](TiDBCloudVPCPrivateEndpoint_en_001_20231017.png)
+ Access TiDB cluster via private subnet (no internet access is required)
+ TiDB Cloud VPC and your VPC can use the same CIDR
------------------------------------------------------------------------------
TiDB Cloud supports one-way access to the TiDB Cloud service hosted in an AWS VPC via the AWS PrivateLink, as if the TiDB cluster were in your own VPC. A private endpoint is exposed in your VPC and you can create a connection to the TiDB Cloud cluster via the endpoint with permission.

Only the Organization Owner and the Project Owner roles can create private endpoints. The private endpoint and the TiDB cluster to be connected must be located in the same region.

With `AWS PrivateLink`, the private endpoint connection supports CIDR overlap and is easier for network planning management.

Please refer to `https://docs.pingcap.com/tidbcloud/set-up-private-endpoint-connections` to complete the configuration of VPC peering.