# AWS PrivateLink endpoint traffic ownership

Apply this topic only when a customer asks whether one or more AWS interface
VPC endpoints used for a TiDB Cloud Private Endpoint have traffic, are still in
use, or can be deleted. Do not apply it to Public Endpoint connectivity,
generic cluster traffic, or Private Endpoint creation and acceptance questions.

An AWS interface endpoint is created in and belongs to the customer's AWS VPC.
Its endpoint-specific usage must therefore be checked by the customer from the
AWS VPC console or other customer-owned AWS telemetry. TiDB-side connection,
query, or network metrics aggregate activity from multiple sources and cannot
establish whether a named `vpce-...` endpoint carried traffic.

Do not promise that Support can separate a named endpoint's traffic from TiDB
aggregate metrics. Ask the customer to verify the specific interface endpoint
on their AWS side over a representative period. Do not recommend deleting the
endpoint until that check and the customer's application dependency review
show that it is unused.

This ownership boundary does not prove that an endpoint is unused, authorize
deletion, or replace incident evidence. It also does not prescribe a particular
AWS metric because available customer-side telemetry depends on the customer's
AWS configuration.

Official reference:

- https://docs.pingcap.com/tidbcloud/set-up-private-endpoint-connections/