# AWS PrivateLink security IP ownership

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "privatelink-security-ip-ownership-2026-09-01",
  "problems": [
    {
      "problemId": "privatelink-security-rule-promises-remote-cluster-ip-range",
      "summary": "A request to narrow AWS PrivateLink security IP rules can be treated as a TiDB Cloud remote-cluster CIDR lookup even though the interface endpoint and its ENIs are in the customer's VPC.",
      "status": "candidate",
      "applicability": "TiDB Cloud AWS Private Endpoint questions asking which IP address or CIDR belongs in a security rule or how to narrow a PrivateLink allowlist.",
      "issueKeys": ["ST-2927"],
      "sourceRefs": [
        "https://tidb.atlassian.net/browse/ST-2927#problem:privatelink-security-rule-promises-remote-cluster-ip-range"
      ],
      "signalTextIncludesAny": [
        "private link 安全配置不需要提供 tidb 的 ip",
        "support can provide a remote cluster private ip range",
        "narrow a privatelink allowlist"
      ],
      "observedThrough": "2026-09-01",
      "effectiveAt": null,
      "verifiedAt": null,
      "attemptedAction": "Add one applicability-bounded product-knowledge topic that directs security-address questions to the customer-owned AWS interface endpoint and ENIs and forbids promising a TiDB Cloud remote-cluster IP or CIDR range.",
      "evidenceUrl": "https://docs.pingcap.com/tidbcloud/set-up-private-endpoint-connections/"
    }
  ]
}
-->

- Optimization ID: `privatelink-security-ip-ownership-2026-09-01`
- Owner: auto-oncall product knowledge consumed by Primary Analysis and the
  Scenario Router
- Source reference: `ST-2927`, selected single-ticket finding
  `st-2927-privatelink-security-ip-knowledge`
- Implementation status: local candidate
- Effective status: `candidate`

## Bounded problem

When a customer asks how to narrow an AWS PrivateLink security IP range, the
answer can incorrectly turn the request into a Support-owned lookup for a TiDB
Cloud remote-cluster CIDR. For AWS PrivateLink, the interface endpoint and its
ENIs are in the customer's VPC, so that remote-range promise has the wrong
ownership boundary.

## Candidate change

Add one searchable topic for PrivateLink security-address and allowlist
questions. It identifies the customer VPC Endpoint and ENIs as the place to
inspect local endpoint addresses, explicitly rejects a promise to supply a
TiDB Cloud remote-cluster range, and leaves the exact security control and any
production change dependent on the customer's AWS topology.

## Verification

The focused regression must prove deterministic recall, topic materialization,
the customer VPC Endpoint/ENI ownership boundary, and the prohibition on a
remote-cluster IP/CIDR promise. Runtime effectiveness remains unverified until
the orchestrator deploys the change and a same-cutoff ST-2927 replay applies
the topic without requiring exact LLM prose.

## Unresolved gaps

The exact source, destination, security-group, network-ACL, or other rule
depends on the customer's AWS configuration and is intentionally not inferred
by this topic. No deployment, replay, or Jira refresh has occurred in this
repair workspace.

## Next validation action

After deployment, run the controller-owned ST-2927 read replay and verify that
the answer uses the customer VPC Endpoint/ENI boundary without promising a
TiDB Cloud remote-cluster range. Only after the authorized write replay and
Jira internal-comment readback may this problem become `optimized_verified`.