Simpler, secure peering with AWS PrivateLink with NetApp Instaclustr for ClickHouse on the NetApp Instaclustr managed platform
May 5, 2026 | By Jaime Borucinski
Support for AWS PrivateLink with NetApp Instaclustr for ClickHouse® is now generally available on the NetApp Instaclustr Managed Platform, giving you a simpler way to connect applications to your ClickHouse services with unidirectional traffic.
In secure environments, traditional private networking approaches such as VPC peering can introduce operational complexity by tightly coupling networks and expanding the trust boundary. This makes it harder to restrict access to only the required service endpoints.
This release introduces AWS‑native private connectivity using AWS PrivateLink to connect ClickHouse workloads that require strong network isolation, simplified cross‑account access, and lower operational overhead.
All ClickHouse resources in the destination VPC are abstracted behind a single AWS PrivateLink service endpoint, simplifying access management while keeping the underlying infrastructure isolated. Traffic between your applications and your Instaclustr for ClickHouse cluster remains on the AWS backbone and does not require public IP addresses or VPC peering.
Additionally, connections are unidirectional and are initiated only from the client side. No inbound network paths are opened into your client VPC. This unidirectional connectivity model provides an additional layer of protection against unintended access.
With this release, AWS PrivateLink with Instaclustr for ClickHouse is production‑ready and generally available as a NetApp Instaclustr Enterprise feature. Our Enterprise Features and Enterprise Add-ons attract an additional charge of 20% on top of the node cost, for the first such feature or add-on enabled by you. NetApp Instaclustr Run-In-Your-Own-Account (RIYOA) customers should note that using PrivateLink may result in additional AWS infrastructure charges. Click here for information on AWS charges. The Enterprise Feature charge covers the AWS PrivateLink costs and all other costs associated with enabling PrivateLink support for Run-In-Instaclustr-Account (RIIA) customers.
Detailed setup steps and prerequisites are documented in the Instaclustr for ClickHouse support documentation.
Log into the NetApp Instaclustr Console to add AWS PrivateLink to your Instaclustr for ClickHouse cluster with just one click today. Alternatively, support for AWS PrivateLink for Instaclustr for ClickHouse is available at the Instaclustr API or Terraform. AWS PrivateLink support is available for Instaclustr for ClickHouse, Instaclustr for Apache Cassandra®, Apache Kafka®, OpenSearch®, PostgreSQL®, and Cadence®, enabling private, one-way connectivity between your VPCs and Instaclustr managed services on AWS.
NetApp Instaclustr Support is available for any assistance with setting up AWS PrivateLink for your Instaclustr for ClickHouse clusters.
