fix(lake): clarify AWS PrivateLink service setup #23636
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -32,17 +32,27 @@ Grab the PrivateLink service name from the **Connect to {{{ .lake }}}** dialog, | |||||
|
|
||||||
|  | ||||||
|
|
||||||
| 4. Go to the [VPC endpoints page](https://us-east-2.console.aws.amazon.com/vpcconsole/home?region=us-east-2#Endpoints) in the AWS Management Console. | ||||||
|
|
||||||
| 1. Click **Create endpoint**. | ||||||
|
|
||||||
|  | ||||||
|
|
||||||
| 2. In **Endpoint settings**, fill in a name tag if needed, and then select **Endpoint services that use NLBs and GWLBs**. | ||||||
|
|
||||||
|  | ||||||
|
|
||||||
| 3. In **Service settings**, paste the service name copied in step 2 into **Service name**, and then click **Verify service**. | ||||||
|
|
||||||
| 4. In **Network settings**, select your VPC. | ||||||
|
|
||||||
| 5. In **Subnets**, select the availability zones and subnets where you want to create the VPC endpoint. | ||||||
|
There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
echo '--- applicable repository conventions ---'
head -5 /tmp/coderabbit-repo-knowledge/pingcap-docs-9c73f70c/*/*.md 2>/dev/null || true
echo '--- target document excerpt ---'
cat -n tidb-cloud-lake/guides/connect-with-aws-privatelink.md | sed -n '35,55p'
echo '--- relevant diff ---'
git diff -- tidb-cloud-lake/guides/connect-with-aws-privatelink.md | sed -n '1,160p'Repository: pingcap/docs Length of output: 2318 🌐 Web query:
💡 Result: When configuring an interface VPC endpoint, you are limited to selecting one subnet per Availability Zone [1][2]. You cannot select multiple subnets from the same Availability Zone for a single interface VPC endpoint [2]. Regarding support for specific Availability Zones, an interface VPC endpoint can only be created in Availability Zones that are supported by the corresponding endpoint service [3]. If you attempt to select a subnet in an Availability Zone not enabled for that endpoint service, the operation will fail [3]. Key points regarding this requirement include: 1. Availability Zone Mapping: The Availability Zones supported by an endpoint service are determined by the service provider (or AWS, for AWS services) by the Availability Zones they have enabled on their Network Load Balancer [4][3]. Because subnet-to-AZ mappings can vary between AWS accounts, it is best practice to use the unique Availability Zone ID (AZ ID) when identifying compatible zones [3]. 2. Troubleshooting: If you encounter an error stating that an endpoint service does not support the Availability Zone of a selected subnet, it indicates that the service provider has not activated that specific zone for their endpoint service [3]. You can verify which Availability Zones are supported by a service by using the describe-vpc-endpoint-services CLI command [3]. 3. High Availability: For production workloads, it is recommended to configure the interface VPC endpoint in at least two Availability Zones to ensure resiliency [5][4]. 4. Automation: Tools like the AWS Cloud Development Kit (CDK) provide parameters (such as lookup_supported_azs) to help automatically identify and restrict subnet selection to only those Availability Zones where the endpoint service is available [6][7]. Citations:
Document the subnet constraints. AWS interface endpoints allow only one subnet per Availability Zone, and the endpoint service must support each selected Availability Zone. Committable replacement- 5. In **Subnets**, select the availability zones and subnets where you want to create the VPC endpoint.
+ 5. In **Subnets**, select one subnet per Availability Zone, and select only Availability Zones supported by the endpoint service.📝 Committable suggestion
Suggested change
🧰 Tools🪛 LanguageTool[style] ~49-~49: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym. (ENGLISH_WORD_REPEAT_BEGINNING_RULE) Sources: Path instructions, MCP tools |
||||||
|
|
||||||
| 6. In **Security groups**, select the security group you prepared in step 3. | ||||||
|
|
||||||
|  | ||||||
|
|
||||||
| 7. Click **Create endpoint**. | ||||||
|
|
||||||
| 5. Wait for the PrivateLink creation. | ||||||
|
|
||||||
|
|
||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Move the screenshot below step 3.
The screenshot is placed after step 2, but it shows the
Service namefield and Verify service button used by step 3. Move the image block to immediately after Line 45 so it illustrates the instruction it documents.As per path instructions: use a regular comment when the fix requires reordering or noncontiguous changes.
Source: Path instructions