Using virtual private endpoints for VPC to privately connect to IBM Cloud Logs

IBM Cloud® Virtual Private Endpoints (VPE) for VPC enables you to connect to IBM Cloud Logs from your VPC network by using the IP addresses of your choosing, allocated from a subnet within your VPC.

VPEs are virtual IP interfaces that are bound to an endpoint gateway created on a per service, or service instance, basis (depending on the service operation model). The endpoint gateway is a virtualized function that scales horizontally, is redundant and highly available, and spans all availability zones of your VPC. Endpoint gateways enable communications from virtual server instances within your VPC and IBM Cloud® service on the private backbone. VPE for VPC gives you the experience of controlling all the private addressing within your cloud. For more information, see About virtual private endpoint gateways.

To connect to IBM Cloud Logs by using a virtual private endpoint, you must use the API or CLI. The IBM Cloud Logs dashboard in the IBM Cloud console must be accessed through the public network from your VPC.

Integrations with IBM Cloud Object Storage buckets and IBM Cloud Event Notifications instances can use public interfaces, based on the configuration of the integration.

Before you begin

Before you target a virtual private endpoint for IBM Cloud Logs you must complete the following tasks.

Ensure that a Virtual Private Cloud is created.
Make a plan for your virtual private endpoints.
Ensure that correct access controls are set for your virtual private endpoint.
Understand the limitations of having a virtual private endpoint.
Understand how to view details about a virtual private endpoint.

Setting up a VPE for IBM Cloud Logs

When you create a VPE gateway by using the CLI or API, you must specify the Cloud Resource Name (CRN) of the IBM Cloud Logs instance as the target.

Configuring an endpoint gateway

To configure a virtual private endpoint gateway, follow these steps:

List the available services, including IBM Cloud infrastructure services available (by default) for all VPC users.
Create an endpoint gateway for IBM Cloud Logs that you want to be privately available to the VPC.
Bind a reserved IP address to the endpoint gateway.
View the created VPE gateways associated with the IBM Cloud Logs. For more information, see Viewing details of an endpoint gateway.

Now your virtual server instances in the VPC can access your IBM Cloud Logs instance privately through it.

Using your VPE for IBM Cloud Logs

After you create an endpoint gateway for IBM Cloud Logs, follow these steps:

Using the VPE with the CLI

Use the following steps to update to the latest version of the CLI and the IBM Cloud Logs plug-in.

Update the IBM Cloud CLI to the latest version:
```
ibmcloud update
```
Update the IBM Cloud Logs CLI plug-in:
```
ibmcloud plugin install cloud-logs
```
Either set the service-url for all commands:
```
ibmcloud logs config set service-url https://<instance_ID>.api.private.<region>.logs.cloud.ibm.com
```
or add it as a parameter for a specific command with --service-url https://<instance_ID>.api.private.<region>.logs.cloud.ibm.com

Using the VPE with the API

After creating an endpoint gateway for the IBM Cloud Logs service, use the service endpoints FQDN <instance_ID>.api.private.<region>.logs.cloud.ibm.com in the URL to access the service.

Using the VPE with the SDK

After creating an endpoint gateway for IBM Cloud Logs, you must use the private endpoint's FQDN when setting the serviceURL <instance_ID>.api.private.<region>.logs.cloud.ibm.com.

Using the VPE with Terraform

If you plan to access the IBM Cloud Logs service using Terraform, make sure to set the IBMCLOUD_LOGS_API_ENDPOINT environment variable to the private FQDN <instance_ID>.api.private.<region>.logs.cloud.ibm.com. For example:

export IBMCLOUD_LOGS_API_ENDPOINT=<instance_ID>.api.private.<region>.logs.cloud.ibm.com