---
title: Dedicated Cloud Gateways
description: Learn how Dedicated Cloud Gateways work and how to configure them.
url: "/dedicated-cloud-gateways/"
canonical_url: "/dedicated-cloud-gateways/"
content_type: landing_page
products:
- Kong Gateway
tags:
- dedicated-cloud-gateways
- gateway-manager
- data-plane-nodes
- aws
- azure
- google-cloud
canonical: true
works_on:
- konnect


---






# Dedicated Cloud Gateways




Dedicated Cloud Gateways are Data Plane nodes that are fully managed by Kong in Konnect. Each Dedicated Cloud Gateway runs on isolated infrastructure within Kong-managed environments in AWS, Azure, or GCP — offering the performance and security of dedicated infrastructure with the operational ease of SaaS.

With Dedicated Cloud Gateways, you don't need to host any Data Planes, and you maintain control over the size and location of the Gateway infrastructure. 
This allows Kong to autoscale your nodes for you and reduces your operational complexity.

Behind the scenes, every Konnect Dedicated Cloud Gateway runs in an individual single-tenant cloud environment, ensuring consistent performance, tenant isolation, and strong security boundaries. The Konnect Control Plane remains multi-tenant.

**Benefits of Dedicated Cloud Gateways:**
- Konnect handles Gateway upgrades for you.
- Choose between public and private networking modes.
- Automatic scaling with Autopilot mode.
- Support for AWS, Azure, and GCP in multiple [regions](/konnect-platform/geos/).

You can manage your Dedicated Cloud Gateway nodes in the [Konnect UI](https://cloud.konghq.com/gateway-manager/).



[Create a Dedicated Cloud Gateway](https://cloud.konghq.com/gateway-manager/create-gateway)

<pre class='mermaid'> 
flowchart TD
A(Dedicated Cloud Gateway Control Plane)
B(Managed Data Plane Node Region 1)
C(Managed Data Plane Node Region 2)

subgraph id1 [Konnect]
A
end

A --auto-scale configuration---> B
A --auto-scale configuration---> C

style id1 stroke-dasharray:3,rx:10,ry:10

  </pre>


## Networking


### AWS

Dedicated Cloud Gateways support both public and private networking on AWS.
Private networking provides enhanced security by restricting API exposure.



* [Transit gateways](/dedicated-cloud-gateways/transit-gateways/)

* [VPC peering](/dedicated-cloud-gateways/aws-vpc-peering/)

* [AWS resource endpoints (REP)](/dedicated-cloud-gateways/aws-resource-endpoints/)



### Google Cloud

Dedicated Cloud Gateways support both private DNS and VPC peering for Google Cloud.



* [VPC peering](/dedicated-cloud-gateways/gcp-vpc-peering/)



### Azure

Konnect can leverage Azure virtual network peering to create virtual networks, ingest data from your provider's services, and expose them to the internet via Konnect.



* [VNET peering](/dedicated-cloud-gateways/azure-peering/)

* [Virtual WAN (VWAN)](/dedicated-cloud-gateways/azure-virtual-wan/)



## Name resolution

We recommend using private name resolution for services running in the same cloud as your Dedicated Cloud Gateway. 
Use private hosted zones or private DNS if your services are in the same cloud. 
Use an outbound DNS resolver if your services are in an external or on-premise DNS server. 


### AWS

Dedicated Cloud Gateways in AWS support private name resolution through AWS private hosted zones and an outbound DNS resolver.



* [Private hosted zones](/dedicated-cloud-gateways/private-hosted-zones/)

* [Outbound DNS resolver](/dedicated-cloud-gateways/outbound-dns-resolver/)



### Google Cloud

Dedicated Cloud Gateways in Google Cloud support private name resolution through Google Cloud private DNS zones.



* [Private DNS zones](/dedicated-cloud-gateways/gcp-private-dns/)



### Azure

Dedicated Cloud Gateways in Azure support private name resolution through Azure private DNS zones and an outbound DNS resolver.



* [VNET peering and private DNS zones](/dedicated-cloud-gateways/azure-vnet-peering-with-private-dns/)

* [VNET peering and outbound DNS resolver](/dedicated-cloud-gateways/azure-vnet-peering-with-outbound-dns-resolver/)

* [VWAN and private DNS zones](/dedicated-cloud-gateways/azure-virtual-wan-with-private-dns/)

* [VWAN and outbound DNS resolver](/dedicated-cloud-gateways/azure-virtual-wan-with-outbound-dns-resolver/)



## Managed cache for Redis


### Managed cache reference

Learn how to size, configure, and scale a Dedicated Cloud Gateway managed cache for Redis. 



* [Read recommendations](/dedicated-cloud-gateways/managed-cache/)



### AWS

Configure a fully-managed Redis service that is provisioned and operated by Kong in AWS ElastiCache.
Use the managed cache in compatible plugins that use Redis.



* [Single control plane](/dedicated-cloud-gateways/aws-managed-cache-control-plane/)

* [Control plane group](/dedicated-cloud-gateways/aws-managed-cache-control-plane-group/)



### Azure

Configure a fully-managed Redis service that is provisioned and operated by Kong in Azure Cache for Redis.
Use the managed cache in compatible plugins that use Redis.



* [Single control plane](/dedicated-cloud-gateways/azure-managed-cache-control-plane/)

* [Control plane group](/dedicated-cloud-gateways/azure-managed-cache-control-plane-group/)



## Dedicated Cloud Gateway network architecture


### Network architecture overview

Learn the architecture of Kong-managed Dedicated Cloud Gateways networks, how they communicate with your cloud infrastructure, and what you must decide before deploying a Dedicated Cloud Gateway.





### Public network architecture

Learn about the public Dedicated Cloud Gateway network architecture and how to secure your public network.





### Private network architecture

Learn about private Dedicated Cloud Gateway network architecture, connectivity options, and how to secure your private network.





### Multi-cloud architecture

Learn how to deploy Dedicated Cloud Gateways across multiple cloud providers, including supported hostname strategies and their tradeoffs.





## Security


### Public network security controls

Learn how to secure your public Dedicated Cloud Gateway network.


[Learn more](/dedicated-cloud-gateways/public-network/#security-controls)


### WAF for private networking

Learn how to secure your private Dedicated Cloud Gateway network with WAF.


[Learn more](/dedicated-cloud-gateways/private-network/#waf)


### Bot Detector (beta) v3.10+

Bot Detector helps identify automated or suspicious traffic using signals like IP addresses, ASN, JA4 fingerprints, user agents, and request paths.
Use Bot Detector to monitor matching traffic in monitor mode, or block matching traffic with configurable rules.


[Learn more](/dedicated-cloud-gateways/bot-detector/)


## Cluster management


### Data Plane nodes

Learn how to set up and manage self-managed and cloud-hosted Data Plane nodes.


[Set up nodes](/gateway/data-plane-reference/)


### Control plane and data plane communication

Learn about how control planes and data plane nodes communicate with each other.


[Learn about CP/DP communication](/gateway/cp-dp-communication/)


## More information


### Supported geos

See which geographical locations are available for Dedicated Cloud Gateways.


[See supported regions](/konnect-platform/geos/)


### Custom domains

Use custom DNS settings for Dedicated Cloud Gateways.


[Set up custom domains](/dedicated-cloud-gateways/reference/#custom-dns)


### Cloud Gateways API

Manage Dedicated Cloud Gateways programmatically using the API.


[See the API](/api/konnect/cloud-gateways/v2/)


### Reference

Dedicated Cloud Gateways reference.


[See the reference](/dedicated-cloud-gateways/reference/)


### Custom plugins

Stream custom plugins from the Control Plane to the Data Plane nodes.


[Set up custom plugins](/dedicated-cloud-gateways/reference/#custom-plugins)