---
name: cli-service-connection
title: Securing your connection when using the IBM Cloud CLI
description: To ensure that you have enhanced control and security over your data when you use the IBM Cloud® Command Line Interface, you have the option of using private routes to IBM Cloud endpoints. Private routes are not accessible or reachable over the internet. By using the IBM Cloud private endpoints feature, you can protect your data from threats from the public network and logically extend your private network.
last-updated: 2024-08-06
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/cli?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Securing your connection when using the IBM Cloud CLI
{: #service-connection}

To ensure that you have enhanced control and security over your data when you use the IBM Cloud® Command Line Interface, you have the option of using private routes to IBM Cloud endpoints. Private routes are not accessible or reachable over the internet. By using the IBM Cloud private endpoints feature, you can protect your data from threats from the public network and logically extend your private network.
{: shortdesc}

The CLI uses the private endpoint support that is provided by the IBM Cloud platform. Platform services that are used by the core CLI, such as IAM, provide private endpoint support.

If your deployment uses the VPC environment of IBM Cloud, private endpoints are exposed through global endpoints. If your deployment uses the Classic environment, regional support is provided for a limited number of CLI commands. The following regions support private endpoints in Classic environments:
* `us-south`
* `us-east`

## Enabling virtual routing and forwarding
{: #cli-private-vrf}

First, enable virtual routing and forwarding in your account, and then you can enable the use of IBM Cloud private service endpoints. For more information about setting up your account to support the private connectivity option, see [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint&format=markdown).

To learn more about private connections on IBM Cloud, see [Secure access to services using service endpoints](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview&format=markdown).

## Logging in to the CLI with a private endpoint
{: #cli-private-login}

You can log in to either a private endpoint for Classic or for VPC. To log in using Classic infrastructure, [log in](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cli&format=markdown#ibmcloud_login) to a private endpoint by using the CLI by using the following command:

```text
ibmcloud login -a private.cloud.ibm.com
```

To [log in](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cli&format=markdown#ibmcloud_login) by using the VPC infrastructure, add the `--vpc` flag to the command:

```text
ibmcloud login -a private.cloud.ibm.com --vpc
```

## Targeting a supported region (required for Classic use)
{: #cli-private-region}

To use private endpoints for deployments in the Classic environment, a region must be targeted when a private endpoint is set in the IBM Cloud CLI.

To [target](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cli&format=markdown#ibmcloud_target) a supported region, use the following command:

```text
ibmcloud target -r [region]
```

## Creating a private endpoint gateway (required for VPC use)
{: #cli-private-vpc}

To use private endpoints for deployments in the VPC environment, you must create a virtual private endpoint gateway. For more information, see [About virtual private endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe&format=markdown).

A list of all IBM Cloud services that are configurable through a virtual private endpoint gateway is at [VPE Supported Services](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-supported-services&format=markdown).

To ensure basic CLI capability against the private endpoint, you must configure the gateway to include these services:
* Account Management: Endpoint URL `(https://private.accounts.cloud.ibm.com)`{: external}
* Cloud Object Storage (use `direct`): [Endpoint URL](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpoints&format=markdown)
* Identity and Access Management: [Endpoint URL](https://cloud.ibm.com/apidocs/iam-identity-token-api#endpoints)
* Global Catalog: [Endpoint URL](https://cloud.ibm.com/apidocs/resource-catalog/global-catalog#endpoint-url)
* Global Search: [Endpoint URL](https://cloud.ibm.com/apidocs/search#endpoint-url)
* Global Tagging: [Endpoint URL](https://cloud.ibm.com/apidocs/tagging#endpoint-url)
* Usage Metering: [Endpoint URL](https://cloud.ibm.com/apidocs/usage-metering#endpoint)
* Enterprise Management: [Endpoint URL](https://cloud.ibm.com/apidocs/enterprise-apis/enterprise#endpoint-url)
* Resource Controller: [Endpoint URL](https://cloud.ibm.com/apidocs/resource-controller/resource-controller#endpoint-url)
* User Management: [Endpoint URL](https://cloud.ibm.com/apidocs/user-management#endpoint-url)

## Determining which CLI plug-ins support private endpoints
{: #cli-private-plugins}

The [`ibmcloud plugin list`](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_settings&format=markdown#ibmcloud_plugin_list) command reports whether an installed CLI plug-in supports private endpoints. If a plug-in that you use does not show private support, you must continue to use it with your API set to the public endpoint `cloud.ibm.com`.

## Installing CLI plug-ins over a private connection
{: #cli-private-plugins-install}

To configure the CLI to install plug-ins over a private connection, you must set up the API of the CLI. Follow the [login instructions](#cli-private-login) to set up the API and indicate VPC as applicable.

## Determining which commands support private endpoints
{: #cli-private-commands}

The following commands support private endpoints:
- `api`
- `login`
- `target`
- `logout`

Most commands under the following namespaces work when you are using private endpoints:
- `account`
- `billing`
- `iam`
- `resource`
- `catalog`

If the CLI is set to access private endpoints and you try to run a command or plug-in that does not yet support private endpoints, you might see an error.
{: note}

The following core commands do not yet support private endpoints:

```text
account
billing
  org-usage
catalog
  template-run
sl
  all commands
app (deprecated)
  all commands
service (deprecated)
  all commands
```