Set up an AWS resource endpoint connection

Before you can configure AWS, you’ll need your account ID for AWS in Konnect. AWS uses this account ID to configure the connection between your resource share in AWS and Konnect.

1. In the Konnect sidebar, click Networks.
2. Click the settings icon next to your network.
3. Click Configure private networking.
4. Click Resource endpoint connection.
5. Copy and save the ID in the Kong AWS Account ID field.

To use AWS resource endpoints with Dedicated Cloud Gateways, you must first create a resource share with your resource configuration group and resource gateway in AWS.

1. In the AWS console, navigate to RAM.
2. Click Create resource share.
3. In the Name field, enter Kong-DCGW-Resource-Share.
4. From the Resource type dropdown menu, select “VPC Lattice Resource Configurations”.
5. Select the ARN of your resource configuration.
6. In the Selected resources settings, select your resource group IDs.
7. Click Next.
8. Click Next.
9. In the Principals settings, select Allow sharing with anyone.
10. From the Select principal type dropdown menu, select “AWS Account”.
11. In the AWS Account field, enter your account ID from Konnect.
12. Click Next.
13. Click Create resource share.

Important: Create a separate RAM share for each shared resource (do not include multiple resources in a single RAM share).

Now that the resource share is configured in AWS, you can connect it with Konnect to enable the resource endpoint connection.

1. In the Konnect sidebar, click Networks.
2. Click the action menu icon next to your network.
3. Click Configure private networking.
4. Click Resource endpoint connection.
5. In the Resource links configuration name field, enter AWS-Resource-Share.
6. In the AWS RAM share ARN field, enter your ARN.

7. Click Submit.

   It may take a few minutes for Konnect’s automation to accept the RAM share and create VPC endpoints. You can check the status of your resource endpoints in the table.

8. Click the action menu icon. Now you need to manually map your resource configuration IDs from AWS to Konnect once your resource endpoint is marked as Ready.
9. Click Edit.

10. In the Resource configuration ID field, enter your enter your resource configuration ID from AWS.

    Note: If your resource configuration has a child resource configuration, use the ID from the child resource.

11. In the Domain name field, enter the domain name you chose in the prerequisites.

    Note: If your resource configuration has a child resource configuration, use the domain name from the child resource.

12. Click Submit.

It may take a few minutes for automation to update the private hosted zones and DNS settings before upstream routing will work.

Once the resource configuration mapping displays as Ready, your resource endpoint connection is set up successfully.

Additionally, you can validate that the resource endpoint connections in Konnect are working correctly by navigating to your Gateway Service configured in the prerequisites:

curl -i -X GET "$UPSTREAM_DOMAIN_NAME"

When using AWS Resource Endpoints with Dedicated Cloud Gateways, your resource gateway is the point of inbound traffic into your VPC for the resource you shared. Traffic from your Dedicated Cloud Gateway arrives at your backend resources sourced from the resource gateway’s own elastic network interface (ENI), using a normal IP address from the subnet you assigned to the resource gateway when you created it.

To allow this traffic, create a dedicated security group for your resource gateway, then reference that security group (not an IP range or prefix list) as the allowed source on your backend target’s security group (for example, EC2 instances, Application Load Balancers, Network Load Balancers, or target Elastic Network Interfaces).

1. In AWS, navigate to your VPC console.
2. From the VPC sidebar, click Security groups.
3. Create a new security group (for example, sg-resource-gateway) and attach it only to your resource gateway.
4. Navigate to the security group for your backend target resource.
5. Add an inbound rule for the relevant port (for example, TCP/443).
6. In the Source field, select the dedicated resource gateway security group you created.

Create a new security group for each backend resource that receives traffic through the resource gateway.

If requests time out and your NLB shows no incoming traffic:

• Verify that the security group attached to your backend allows inbound traffic from the resource gateway’s dedicated security group.
• Confirm your resource gateway’s subnet has an Availability Zone (AZ) that overlaps with your Dedicated Cloud Gateway network’s AZs. This is a common, hard-to-diagnose failure mode: without AZ overlap, the resource endpoint config can show as missing in Konnect, even though nothing else is misconfigured.
• Validate the Resource Endpoint connection is in the READY state in Konnect.
• Confirm the Gateway Service upstream host matches the Resource Endpoint domain name.
• Check NLB target group health.
• Confirm backend subnet network access control lists (NACLs) allow inbound and outbound traffic from the resource gateway’s subnet. Security groups are stateful; a restrictive NACL silently drops the return path.
• Confirm the NLB listener protocol and port matches the resource configuration’s accepted listener.