Problem statement

What is AWS PrivateLink : https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html

Problem to solve:

Customers who are hosted on AWS may require private paths to connect their WxO instance on AWS to their on-premise environment and/or 3rd-party cloud provider

Scope

• Description : AWS PrivateLink is a highly available, scalable technology that you can use to privately connect your VPC to services and resources as if they were in your VPC. You do not need to use an internet gateway, NAT device, public IP address, AWS Direct Connect connection, or AWS Site-to-Site VPN connection to allow communication with the service or resource from your private subnets. Therefore, you control the specific API endpoints, sites, services, and resources that are reachable from your VPC.

• Requirements :

  • PrivateLink setup inbound for customers to call Channels and/or WXO API (not assistant builder at this time). Can be a manual invite/accept process to start, but needs to be added to the WXO Admin UI eventually.

  • PrivateLink setup for outbound (Tools/MCP, AI Gateway to LLMs, External Knowledge Stores, External Agents). This should be integrated with the connections API/UI.

  • All of this setup should be Admin only. And we need sufficient network protection in place in our ROSA Cluster/VPC to prevent Customer A from using Customer B's PrivateLink.

  • Will required for AWSGov Cloud (FEDRAMP) customers