This topic is intended for Tamr customers who want Tamr webhook events to be delivered into their own AWS account over AWS PrivateLink, without exposing a public webhook receiver.

Separately, Tamr also supports:

• Calling the Tamr APIs over AWS PrivateLink. See Reaching the Tamr API over AWS PrivateLink.
• Restricting S3 bucket access to Tamr VPC endpoints for your data connections. See Restricting S3 Bucket Access to Tamr VPC Endpoints.

Benefits of Using AWS PrivateLink for Webhook Events

• Nothing exposed to the internet: Your webhook receiver has no public name or address.
• No IP allowlisting: Access is granted to Tamr's AWS account, so the configuration remains in place if addresses change.
• No CIDR coordination: PrivateLink does not join the networks; your address space and Tamr's may overlap.
• One-way connection: Tamr reaches the one port you publish and nothing else in your VPC.
• You approve the connection; rejecting it immediately revokes Tamr's access.

Requirements for VPC Endpoint Service

Publish your webhook receiver as a VPC endpoint service. Tamr creates an endpoint to it in its own VPC.

• An internal Network Load Balancer (NLB) in front of your webhook receiver, listening on TCP. An endpoint service can only sit in front of an NLB. Behind it, the receiver can be anything in your VPC: ECS, EKS, EC2, or a Lambda behind an internal AWS Application Load Balancer (ALB) (an NLB can't target a Lambda directly).
• A VPC endpoint service on that NLB, with acceptance_required = true and Tamr's account,
  arn:aws:iam::013081881335:root, as an allowed principal.
• Subnets in at least two Availability Zones, preferably every AZ in the region, so that Tamr's endpoint can always find a zone you serve.
• A publicly trusted TLS certificate on the receiver, for a hostname you own.

Your endpoint service must be in one of the AWS regions from which Tamr sends webhook events:

• us-east-1
• eu-central-1
• eu-west-1
• eu-west-2
• ap-southeast-1
• ap-northeast-1

Configuration

Work with Tamr to configure webhook event delivery over AWS PrivateLink, as follows:

1. Obtain the connection details:

   • the endpoint service name, com.amazonaws.vpce.<region>.vpce-svc-…;
   • the AZ IDs your service is available in (use1-az2, not us-east-1a; names are per-account aliases);
   • the port, usually 443;
   • the hostname your certificate is issued for, and the URL path to which to send webhooks.

2. Provide the above connection details to Tamr by sending an email to Tamr Support ([email protected]). Tamr Support will work with Tamr Operations to create its endpoint to your service. Inside Tamr's VPC, your hostname resolves to that endpoint; TLS verification passes against your certificate.
   
   Once created, Tamr Support will supply Tamr's endpoint ID. Move to step 3.

3. Accept the connection in your account:

   Bash

   aws ec2 accept-vpc-endpoint-connections \
     --service-id vpce-svc-0123456789abcdef0 --vpc-endpoint-ids vpce-0123456789abcdef0

4. Notify Tamr that you accepted the connection by sending an email to Tamr Support ([email protected]) to notify Tamr that you have accepted the connection.

5. Tamr Operations sends a test webhook event.

6. Confirm that the test webook reached your webhook receiver.

Webhook Source and Authentication

Requests arrive from your NLB's private IPs, not from Tamr's addresses; the source is translated at Tamr's endpoint and again at your load balancer.

Authenticate webhooks at the application layer, for example with the signature header or token configured on the webhook, not by source address.

Limits

• Your NLB's idle timeout must be longer than your receiver's longest response time; otherwise, slow deliveries are cut off.
• The endpoint's MTU is 8500 bytes, with no path MTU discovery. An ALB in front of a Lambda also caps request bodies at 1 MB.

Pricing

Tamr incurs the cost for its endpoint, while you pay for your NLB and endpoint service, per standard PrivateLink pricing.

Troubleshooting