Skip to main content
AWS PrivateLink is available on Enterprise plans. Contact your Revyl account team or [email protected] to enable it for your organization before you start.

​
Verify the connection

Work through these in order. Each check rules out one layer.
1

Endpoint connection is Available

Expect one row with owner 992382537093 (Revyl) and state available.
2

Targets are healthy in every zone

Every target should be healthy. With cross-zone load balancing on, one healthy target is enough for all zones.
3

Traffic is arriving at the NLB

In CloudWatch, under the AWS/NetworkELB namespace, watch NewFlowCount and ActiveFlowCount for your NLB while Revyl runs a check. On an NLB that only serves Revyl, a rise during the check means the PrivateLink leg works. On a shared NLB, your other clients keep these metrics busy, so they prove nothing about Revyl. Confirm Revyl’s request in your target access logs at the time of the check instead. If your targets can parse it, proxy protocol v2 on the target group also works: its header carries the VPC endpoint ID. Targets that cannot parse proxy protocol reject every connection once it is on.TCP_Target_Reset_Count or TCP_ELB_Reset_Count spikes point at your targets or listener.
4

A real job succeeds

Ask Revyl to run the connectivity check again, then run a build or test that depends on the private service. Successful dependency resolution or API calls confirm DNS, routing, and TLS all line up.

​
Common problems

  • Revyl’s principal is missing from Allow principals, or has a typo.
  • The service is in a region other than us-west-2 and us-west-2 is not in its Supported Regions.
  • The service name you sent has a typo. Copy it from the console or from describe-vpc-endpoint-service-configurations.
Acceptance is required and the request has not been accepted yet. Accept it from Endpoint connections, or with aws ec2 accept-vpc-endpoint-connections. If you use the Terraform accepter resource, make sure it was applied.
The request reaches your side but nothing answers.
  • AZ mismatch (services in us-west-2). Your NLB has no subnet in usw2-az2. Compare AZ IDs, not names.
  • NLB security group. Turn off Enforce inbound rules on PrivateLink traffic. With it on, rules match the private IP of Revyl’s client, so a rule that allows only your VPC CIDR blocks Revyl. The SecurityGroupBlockedFlowCount_Inbound metric counts these drops.
  • Target security group or NACL. Targets must accept traffic from the NLB on the target port.
  • No healthy targets in usw2-az2. With cross-zone load balancing off, Revyl’s traffic is blackholed even while your other zones are healthy. Turn cross-zone on, or restore healthy capacity in usw2-az2. See Cross-zone load balancing.
  • Wrong port. The listener port must match the port in the hostname list you sent Revyl.
Usually an ALB behind your NLB with a zone imbalance. Revyl enters only through usw2-az2, so it sees that zone’s targets, while your other clients are spread across every zone.
  • ALB target group with cross-zone off: check that usw2-az2 has enough healthy targets. An empty zone returns 503 for every request.
  • ALB not enabled in usw2-az2: enable it there.
  • Long-lived connections stay on their original path after you fix the zone. Ask Revyl to rerun the job so it opens new connections.
See Fronting an Application Load Balancer.
The NLB answered but the target rejected the connection. Confirm the service listens on the target group port, and that the target group protocol matches the listener (TCP to TCP, or TLS to TCP when the NLB terminates TLS).
The hostname or port is not mapped to your endpoint. This often happens with redirects: a registry answers on one host and redirects downloads to another, or a Git server redirects to a different port. Send Revyl every hostname and port your clients follow.
Clients connect using your real hostname, so your service’s certificate must be valid for that hostname. If your certificate is issued by a private CA, the build or app must trust that CA. For builds, install it in your build setup; for apps under test, include it in the build you upload.
  • Someone rejected the connection or removed Revyl’s principal.
  • The NLB lost a subnet, or the targets were replaced and are unhealthy.
  • A new hostname or port was introduced without being sent to Revyl.
Check the endpoint connection state first, then target health.

​
What to send Revyl support

When you contact [email protected] about a PrivateLink issue, include:
  • Your Revyl organization and endpoint service name.
  • The hostname and port that fails, and the approximate time of the failure.
  • The exact client error, for example the build log line or the app error.
  • Output of the endpoint connection and target health checks above.
Do not send credentials, tokens, or certificate private keys.

​
Offboarding

You can revoke Revyl’s access at any time, without involving Revyl.
Reject the endpoint connection. Traffic stops right away.