setup-openflow-privatelink

Overview

Connect OpenFlow on SPCS to private data sources (RDS, on-prem DBs reachable via Direct Connect/VPN) through AWS PrivateLink. The flow:

OpenFlow (SPCS) → EAI → Network Rule (PRIVATE_HOST_PORT)
                  → Outbound PrivateLink Endpoint
                  → AWS VPC Endpoint Service → Internal NLB
                  → Target Group(s) → RDS / on-prem DB (via TCP proxy if needed)

Each NLB listener uses a unique port (any port > 1024) so multiple instances sharing the same backend port (e.g., two MySQL on 3306) can be disambiguated.

Prerequisites

• AWS permissions: NLB, target groups, endpoint services, security groups
• Snowflake ACCOUNTADMIN
• OpenFlow already deployed on SPCS
• One or more data sources in a private VPC (or on-prem with VPC connectivity)