# Cross-region configuration

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Faws%2Faws-privatelink%2Faws-privatelink-cross-region-connection.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Faws%2Faws-privatelink%2Faws-privatelink-cross-region-connection.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

Use this guide when your AWS resources and your Coralogix domain are hosted in different AWS regions.

Native cross-region PrivateLink is the preferred and AWS-recommended approach for multi-region connectivity. It removes the need for VPC peering, manual routing, and Availability Zone (AZ) alignment.

## Why use native cross-region PrivateLink[​](#why-use-native-cross-region-privatelink "Direct link to Why use native cross-region PrivateLink")

Native cross-region PrivateLink replaces complex, manually managed networking with an AWS-managed connection between regions.

Key benefits include:

* No VPC peering or route table configuration
* No Availability Zone alignment required
* IAM-based access control
* Built-in high availability with automatic routing across healthy zones
* Lower operational overhead with fewer networking components

## Best practices[​](#best-practices "Direct link to Best practices")

### Availability Zone selection[​](#availability-zone-selection "Direct link to Availability Zone selection")

You have full flexibility when selecting Availability Zones for your VPC endpoint. AZs do not need to match Coralogix’s deployment AZs. AWS automatically routes traffic between your selected AZs and Coralogix’s service AZs.

When selecting AZs, consider the following:

* **High availability**: Choose at least 2 AZs for redundancy
* **Performance**: Select AZs closest to your workloads
* **Cost optimization**: Inter-AZ data transfer via PrivateLink endpoints is free according to [AWS's April 2022 announcement](https://aws.amazon.com/about-aws/whats-new/2022/04/aws-data-transfer-price-reduction-privatelink-transit-gateway-client-vpn-services/)
* **Compliance**: Choose AZs that meet your regulatory requirements

### Security and performance[​](#security-and-performance "Direct link to Security and performance")

* Ensure your security groups allow outbound HTTPS traffic (port 443) to the VPC endpoint.
* Use the Coralogix private DNS name for consistent routing and failover
* Validate connectivity from workloads running in multiple AZs

## Prerequisites[​](#prerequisites "Direct link to Prerequisites")

Before configuring a cross-region endpoint:

* Identify the correct Coralogix PrivateLink service endpoints for your Coralogix domain using the Coralogix PrivateLink endpoints and deployment page.
* Ensure the IAM user or role creating the endpoint has the `vpce:AllowMultiRegion` permission

## Set up[​](#set-up "Direct link to Set up")

### Step 1: Grant required IAM permission[​](#step-1-grant-required-iam-permission "Direct link to Step 1: Grant required IAM permission")

The IAM user or service creating the cross-region endpoint must be explicitly allowed to create multi-region endpoints.

Attach the following policy to the user or role:

```
{

  "Version": "2012-10-17",

  "Statement": [

    {

      "Sid": "AllowMultiRegionPrivateLink",

      "Effect": "Allow",

      "Action": [

        "vpce:AllowMultiRegion"

      ],

      "Resource": "*"

    }

  ]

}
```

### Step 2: Create the cross-region VPC endpoint[​](#step-2-create-the-cross-region-vpc-endpoint "Direct link to Step 2: Create the cross-region VPC endpoint")

1. In the AWS Console, navigate to VPC, then PrivateLink and Lattice, then Endpoints.

2. Select **Create endpoint.**

   [![Step 2.2](/docs/assets/images/cross_region_2_2-fdf79c8338e11c6a3c30e6c41fa3205c.webp)](https://coralogix.com/docs/docs/assets/images/cross_region_2_2-fdf79c8338e11c6a3c30e6c41fa3205c.webp)

3. Enter the Coralogix service name associated with the Coralogix-hosting region.

4. Choose **PrivateLink Ready partner services** as the service category.

   [![Step 2.4](/docs/assets/images/cross_region_4-8a521eafa97664fdb1fe64862ceecb15.webp)](https://coralogix.com/docs/docs/assets/images/cross_region_4-8a521eafa97664fdb1fe64862ceecb15.webp)

5. Enable the **cross-region endpoint** option and select the region matching the chosen Coralogix service.

   [![Step 2.5](/docs/assets/images/cross_region_5-01bdc804e901b119be7a313dc162239e.webp)](https://coralogix.com/docs/docs/assets/images/cross_region_5-01bdc804e901b119be7a313dc162239e.webp)

6. Choose **Verify service** to confirm that the service is accessible.

### Step 3: Configure VPC and subnets[​](#step-3-configure-vpc-and-subnets "Direct link to Step 3: Configure VPC and subnets")

1. In **Network Settings**, select the VPC in your local region where the endpoint will be created.
2. Expand the **Additional settings** section and **Enable DNS name**.
3. Under **Subnets**, select at least two availability zones for redundancy and high availability.

### Step 4: Configure security groups[​](#step-4-configure-security-groups "Direct link to Step 4: Configure security groups")

Attach a security group that allows inbound TCP traffic on port 443 to the endpoint network interfaces.

### Step 5: Validate endpoint status[​](#step-5-validate-endpoint-status "Direct link to Step 5: Validate endpoint status")

1. Wait for the endpoint status to change from **Pending** to **Available**. This may take a few minutes.

2. Once available, note the generated DNS names:

   <!-- -->

   * AZ-specific VPC endpoint DNS names
   * The Coralogix private DNS name (for example, `ingress.private.<your-domain>`)

### Step 6: Validate connectivity[​](#step-6-validate-connectivity "Direct link to Step 6: Validate connectivity")

Validate connectivity using one of the following methods:

* From a workload inside the VPC, test TCP connectivity on port 443 to the Coralogix private DNS name

  ```
  # example US region

  # telnet ingress.private.us1.coralogix.com

  telnet ingress.private.<region-domain> 443
  ```

* Send a test log using the [Coralogix REST API `/singles` endpoint](https://coralogix.com/docs/docs/developer-portal/apis/log-ingestion/coralogix-rest-api-singles/.md)

## Limitations and considerations[​](#limitations-and-considerations "Direct link to Limitations and considerations")

* Cross-region connectivity only works when both regions are in the same [AWS partition](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/partitions.html). For example, connecting `us-east-1` and `eu-west-1` is supported, but connections between `aws-us-gov` (AWS GovCloud) and `aws-cn` (AWS China) partitions are not.
* Cross-region connectivity is only supported for Interface type VPC endpoints.
* Both your region and the Coralogix service region must be in the same AWS partition.
* Cross-region endpoints count toward your Interface VPC Endpoints per VPC quota.