---
updatedAt: 2026-07-28T13:22:14.000Z
agentTools:
  projectIndex: https://docs.getmontecarlo.com/llms.txt
---

# Agent Service AWS PrivateLink

# About

For deployments where you prefer to connect privately to the Monte Carlo Agent Service, you can utilize VPC endpoints. This helps ensure that traffic between your network and the Monte Carlo Agent Service can connect without being exposed to the internet. For additional details, please refer to the [AWS PrivateLink Overview](https://aws.amazon.com/privatelink/).

# Requirements

* **Monte Carlo Role, Subscription, and Supported Type:** You must have the [Account Owner role](https://docs.getmontecarlo.com/docs/authorization#managed-roles-and-groups) in Monte Carlo. Additionally, your account must be subscribed to the Enterprise tier with the Advanced Networking add-on.
* **AWS Admin**: Administrative access to AWS is necessary for the setup.

# Setup

1. **Share Your AWS Account ID**\
   Contact us at <platform@montecarlo.ai> to request the establishment of a PrivateLink to the Agent Service. Include the following in your email:

   * **Monte Carlo Account ID** (can be found [here](https://getmontecarlo.com/profile))
   * **AWS Account ID** where you will create the VPC endpoint
   * **AWS Region** where you will create the VPC endpoint

   Monte Carlo will allowlist your AWS account and notify you once access has been granted.

   > 🕒
   >
   > **Note:** Do not proceed until you receive confirmation from Monte Carlo that your account has been allowed.
   >
   > Typically, you will receive a response within 24-48 hours (US business days).

2. **Obtain the VPC Endpoint Service Name**\
   Navigate to the [Account Information](https://getmontecarlo.com/account-info#agent-service) page in Monte Carlo. Under the Agent Service section, locate and take note of the values for **Region** and **VPC endpoint service name**.

3. **Create a VPC Endpoint**\
   In the AWS console, navigate to the VPC section and create an interface VPC endpoint in the VPC and subnet(s) where your agent is deployed. When configuring the endpoint:

   * Under **Service category**, select **Endpoint services that use NLBs and GWLBs**.
   * Enter the **VPC endpoint service name** obtained in Step 2.
   * Select **Enable Cross Region endpoint** if your agent is deployed in a different region than the VPC endpoint, and select the region from Step 2.
   * Click **Verify service**.
   * Select the **VPC** and **subnet(s)** where your agent is deployed.
   * Assign a **security group** that allows outbound HTTPS (port 443) traffic.

4. **Configure DNS Resolution**\
   After the endpoint is created, you need to configure DNS so that the Agent Service Private Link Hostname resolves to the VPC endpoint. You can find the **Private link endpoint** in the [Account Information](https://getmontecarlo.com/account-info#agent-service) page, under Agent Service.

   To do this, create a Route 53 Private Hosted Zone and associate it with your VPC:

   For example, if the hostname is `artemis.privatelink.getmontecarlo.com`, the hosted zone is `privatelink.getmontecarlo.com` and the record name is `artemis`.

   * In the Route 53 console, create a **Private Hosted Zone** with the domain portion of the hostname (e.g., `privatelink.getmontecarlo.com`).
   * Associate the hosted zone with the VPC where your VPC endpoint resides.
   * Add a **CNAME record** that maps the subdomain (e.g., `artemis`) to the VPC endpoint's DNS name. You can find this DNS name under the **Details** tab of the VPC endpoint in the AWS console.

5. **Request Connection Approval**\
   Contact us at <platform@montecarlo.ai> to request approval of the VPC endpoint connection. Include your **VPC Endpoint ID** in your email. Monte Carlo will approve the connection and notify you once the process is complete.
   > 🕒
   >
   > **Note:** Do not proceed until you receive confirmation from Monte Carlo that the connection has been approved.
   >
   > Typically, you will receive a response within 24-48 hours (US business days).

6. **Verify Connectivity**\
   First, confirm that the VPC endpoint connection status shows as **Available** in the AWS console.

   Then, update the Generic Agent configuration setting `backendServiceUrl` to use the Agent Service private link endpoint from Step 4:

   ```yaml Example values.yaml
   container:
     backendServiceUrl: https://artemis.privatelink.getmontecarlo.com
   ```

   Complete the deployment for the Generic Agent and onboard the agent on Monte Carlo to verify connectivity.

If you prefer, you can also use the AWS API, CLI, or any other tool of your choice to manage and update any configuration.