# AWS PrivateLink security IP ownership

Apply this topic only when a customer asks which IP address or CIDR belongs in
a security rule for a TiDB Cloud Private Endpoint, or asks how to narrow an
existing PrivateLink allowlist. Do not apply it to Public Endpoint
connectivity, cross-Region support, endpoint traffic or deletion decisions, or
generic cluster network diagnostics.

For AWS PrivateLink, the customer creates an interface VPC endpoint in the
customer's own AWS VPC. The endpoint is exposed through endpoint network
interfaces (ENIs) in the customer-selected subnets, and the endpoint's local
private IP addresses belong to those ENIs. Inspect the corresponding VPC
Endpoint and its ENIs in the customer's AWS account when identifying those
local addresses.

Do not promise that Support can provide a TiDB Cloud remote-cluster private IP
or CIDR range for this purpose. Application traffic is directed to the
customer-side interface endpoint, so a remote TiDB Cloud cluster range is not
a substitute for the endpoint and ENI information in the customer's VPC.

This ownership boundary does not determine which exact source, destination,
security-group, network-ACL, or other rule the customer should configure. That
depends on traffic direction and the customer's AWS topology and controls.
Verify the intended rule and the current VPC Endpoint/ENI configuration before
changing it; this topic does not authorize a production network change.

Official reference:

- https://docs.pingcap.com/tidbcloud/set-up-private-endpoint-connections/