> ## Documentation Index
> Fetch the complete documentation index at: https://docs.controlplane.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PrivateLink with RDS

> Provision an AWS RDS instance with PrivateLink for secure private connectivity to Control Plane workloads using Terraform.

## Overview

Follow the steps below to provision (or integrate with existing) an [RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Welcome.html) instance with a [PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html) endpoint in AWS for Control Plane connectivity.

## Create using Control Plane Terraform

### Modes

1. **Create New Infrastructure (default)**
   * RDS, Secret Manager Secret and VPC infrastructure will be created along with networking resources.
2. **Existing Infrastructure**
   * Uses your preexisting RDS, Secret Manager Secret and VPC infrastructure to create networking resources.
   * To use this mode, you must provide your RDS ARN and Secret Manager Secret ARN.

### What's Created

<Accordion title="Using Create Infrastructure Mode:">
  * VPC & Subnets
  * RDS PostgreSQL Instance (multi-AZ)
  * Secrets Manager (secure credential storage)
  * RDS Proxy (connection pooling and failover)
  * Network Load Balancer
  * Lambda Function (dynamic IP updates)
  * PrivateLink Endpoint Service
</Accordion>

<Accordion title="Using Existing Infrastructure Mode:">
  * RDS Proxy (connection pooling and failover)
  * Network Load Balancer
  * Lambda Function (dynamic IP updates)
  * PrivateLink Endpoint Service
</Accordion>

### Prerequisites

**Software Requirements:**

* Install AWS [CLI](https://aws.amazon.com/cli/).
* Install Terraform [CLI](https://developer.hashicorp.com/terraform).
* [Git](https://git-scm.com/) (for cloning the repository).

**AWS Account Requirements:**

* [Amazon Web Service (AWS)](https://aws.amazon.com/) account with billing enabled.
* AWS IAM User/Role with appropriate permissions (VPC, RDS, Lambda, NLB, Secrets Manager, IAM, CloudWatch, etc.).
* Deploy resources in the same region as your Control Plane [workload](/concepts/workload).

**Existing RDS Requirements:**

* VPC, subnets, and RDS infrastructure already created and available.
* Create Secrets Manager Secret with database credentials in the following JSON format.
  ```JSON theme={null}
  {
  "username": "your_db_username",
  "password": "your_db_password"
  }
  ```

### Step 1 - Clone Control Plane Terraform

```bash theme={null}
git clone https://github.com/controlplane-com/cpln-rds-producer
cd cpln-rds-producer
```

* This [repository](https://github.com/controlplane-com/cpln-rds-producer) contains Terraform modules for provisioning AWS infrastructure that integrates with Control Plane via PrivateLink.

### Step 2 - Create Configuration File

* Create a `terraform.tfvars` file in the root of the cloned repository.
* **For using Create New Infrastructure mode:**
  ```hcl terraform.tfvars theme={null}
  aws_region = "us-west-2"
  db_username = "postgres"
  db_password = "SecurePassword123!"
  ```
* **For using Existing Infrastructure mode:**
  ```hcl terraform.tfvars theme={null}
  db_instance_arn = "arn:aws:rds:us-west-2:123456789012:db:my-db"
  secret_arn = "arn:aws:secretsmanager:us-west-2:123456789012:secret:my-secret"
  ```

### Step 3 - Deploy Infrastructure

* Run the Terraform with your configuration:

```bash theme={null}
terraform init
terraform plan
terraform apply
```

* The Terraform will automatically provision all necessary resources and output your PrivateLink endpoint service name.

* For more information, refer to the [repository README](https://github.com/controlplane-com/cpln-rds-producer#control-plane-rds-producer-terraform-modules)

## Next Steps

* Contact <a href="mailto:support@controlplane.com">[support@controlplane.com](mailto:support@controlplane.com)</a> with your service name and region.
* Control Plane will use this to create the consumer-side endpoint connection.
* Once notified that the consumer endpoint has been created, go to your AWS Console:
  * Navigate to `VPC` and to `Endpoint Services`.
  * Click on your PrivateLink service.
  * Under Pending endpoint connections, select the pending request.
  * Click the `Actions` dropdown and accept endpoint connection request.
* Proceed to follow the [Native Networking Setup](/guides/native-networking/native-networking-setup) in Control Plane.