This topic is intended for Tamr customers who want to call the Tamr API from their own AWS account over AWS PrivateLink, ensuring that requests never cross the public internet.

Separately, Tamr also supports:

• Delivering webhook events over AWS PrivateLink. See Receiving Tamr Webhooks over AWS PrivateLink.
• Restricting S3 bucket access to Tamr VPC endpoints for your data connections. See Restricting S3 Bucket Access to Tamr VPC Endpoints.

Benefits of Using AWS PrivateLink for API Calls

• No internet egress for Tamr traffic: No NAT gateway, internet gateway, or proxy allowlist entry.
• No CIDR coordination: PrivateLink does not join the networks; your address space and Tamr's may overlap.
• A one-way connection: You reach the Tamr API and nothing else; Tamr has no path into your VPC.
• No application changes: Your clients continue to call their normal tenant hostname, and DNS inside your VPC sends the call to the endpoint.

Tamr's Endpoint Services

Connect from a VPC in your Tamr Cloud tenant region. Each endpoint service serves every Availability Zone (AZ) in its region.

If you have Tamr Cloud tenants in more than one region, use a separate VPC and endpoint for each region.

Configuration

Work with Tamr to configure calling the Tamr API over AWS PrivateLink, as follows:

1. Obtain the IAM role that will create the endpoint, for example
   arn:aws:iam::123456789012:role/terraform-deploy, and the region you'll connect from. If you cannot name a role, obtain your AWS account ID instead.

2. Send the IAM role and region to Tamr. Send an email to Tamr Support ([email protected]) with the IAM role or AWS account ID and the region. Tamr Support will work with Tamr Operations to allow that principal on the endpoint service. When Tamr indicates that this is complete, move to step 3.

3. Create the endpoint with the terraform-aws-privatelink-consumer module, using the endpoint service name for your region from the table above:

   hcl

   module "tamr_api_privatelink" {
     source = "git::https://github.com/Datatamer/terraform-aws-privatelink-consumer.git?ref=v1.0.0"
   
     vpc_id                = "vpc-0123456789abcdef0"
     subnet_ids            = ["subnet-aaa", "subnet-bbb", "subnet-ccc"]
     endpoint_service_name = "com.amazonaws.vpce.us-east-1.vpce-svc-0872dfc176e4843ab"
     allowed_cidrs         = ["10.0.0.0/16"]
     api_domain            = "tamr.cloud"
   }

   Set api_domain to the tenant domain from the same row. The module creates the interface endpoint, a security group admitting your clients on 443, and a private hosted zone for api_domain inside your VPC. The endpoint starts in pendingAcceptance.

4. Obtain the endpoint ID (the module's vpc_endpoint_id output).

5. Send the endpoint ID to Tamr by emailingTamr Support ([email protected]). Tamr Support will work with Tamr Operations to accept the connection. Once accepted, the endpoint becomes available. Move to step 6.

6. Check the configuration from an instance in your VPC that allowed_cidrs covers:

   Bash

   dig +short your-tenant.tamr.cloud
   curl -v https://your-tenant.tamr.cloud/api/v1alpha/record/list

   The name should resolve to private IPs in your VPC, and an unauthenticated request should get HTTP 403 with a valid certificate. That means the private path works end-to-end. With no instance in the VPC, the module's test client makes the same request for you; see its README.

DNS

Inside your VPC, the private hosted zone takes over all of your tenant domain: every name under it resolves to the endpoint. Resolution outside the VPC is untouched. If you already manage a hosted zone for that domain in the VPC, set create_private_hosted_zone = false and add an alias record pointing at the module's endpoint_dns_name output.

Always call your tenant hostname. The endpoint's own vpce-… hostname does not match Tamr's certificate and is not routed by Tamr.

Other VPCs and on-premises networks can use the same endpoint over peering, Transit Gateway, VPN or Direct Connect. They also need the private hosted zone associated with them, or Route 53 Resolver inbound endpoints for networks outside AWS.

Availability Zones

Use AZ IDs (use1-az4), not AZ names (us-east-1a): names are per-account aliases and point at different data centers in different accounts. A subnet in an AZ ID that the service does not serve fails with "endpoint service does not support the Availability Zone (AZ) for the subnet". Check your subnets:

aws ec2 describe-subnets --subnet-ids subnet-aaa subnet-bbb subnet-ccc \
  --query 'Subnets[].[SubnetId,AvailabilityZoneId]' --output table

Use one subnet per AZ.

Source IPs and Authorization

Your source IP is not visible to Tamr; traffic is translated at the endpoint and again at Tamr's load balancer. Authorization is entirely at the application layer, through your API credentials. This means that Tamr cannot allowlist your addresses, and you cannot allowlist Tamr addresses.

Limits

• The endpoint's MTU is 8500 bytes, with no path MTU discovery. This only matters for very large request bodies.
• Your account has a quota of 50 interface endpoints per VPC by default.

Pricing

Tamr does not charge for the connection. You pay AWS for endpoint hours and data processed, per standard PrivateLink pricing.

Troubleshooting