--- name: key-protect-virtual-private-endpoints title: Accessing virtual private endpoints in specific regions description: After you create your VPC, you can create a virtual private endpoint (VPE) to connect to Key Protect for your data encryption needs. The VPE allows you to access Key Protect within your VPC network. last-updated: 2026-05-19 --- {:shortdesc: .shortdesc} {:screen: .screen} {:pre: .pre} {:table: .aria-labeledby="caption"} {:external: target="_blank" .external} {:codeblock: .codeblock} {:tip: .tip} {:note: .note} {:important: .important} {:preview: .preview} # Accessing virtual private endpoints in specific regions {: #virtual-private-endpoints} After you create your VPC, you can create a virtual private endpoint (VPE) to connect to Key Protect for your data encryption needs. The VPE allows you to access Key Protect within your VPC network. {: shortdesc} You can configure the VPE to use IP addresses of your choice from a subnet within your VPC. VPEs bind to a [VPE gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe) and serve as an intermediary that enables your workload to interact with Key Protect. ## Before you begin {: #vpe-prereqs} Before you target a VPE for Key Protect: - Make sure that you have [provisioned a Virtual Private Cloud](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started){: external}. - Make sure that you have conducted [planning for Virtual Private Endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-planning-considerations){: external}. - Make sure that you set the [correct access controls](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls){: external} for your VPE. - Understand the [limitations](https://cloud.ibm.com/docs/monitoring?topic=monitoring-vpe-connection#vpe-limitations){: external} of having a VPE. - Make sure that you [created](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-endpoint-gateway){: external} a VPE gateway and understand how to [access](https://cloud.ibm.com/docs/vpc?topic=vpc-accessing-vpe-after-setup){: external} it. - Understand how to [view details](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-viewing-details-of-an-endpoint-gateway){: external} of a VPE. You might need to manually update VPE settings, specifically the Internet Protocol (IP) address, during [Disaster recovery and business continuity actions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-shared-responsibilities#disaster-recovery). {: important} ## Virtual Private Service Endpoints {: #vpe-endpoints} The following table lists regions where Key Protect supports VPE. It also lists the Key Protect endpoints that are supported from each region. You can connect to Key Protect in another region by using supported endpoints. For example, from the Sydney region, you can use Key Protect in the `us-south` region by using the us-south endpoint. When you connect to a VPE by using the [CLI](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-endpoint-gateway&interface=cli) or [API](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-endpoint-gateway&interface=api), specify the CRN of the region that you use to connect to Key Protect. Use the following table to locate the CRN of the target region. {: note} | Region | Endpoints Supported in Region | CRN | |------------|--------------------------------------|------------------------------------------------------------------------------------| | Dallas | | | | | `private.us-south.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:us-south:::endpoint:private.us-south.kms.cloud.ibm.com` | | | `private.us-east.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:us-east:::endpoint:private.us-east.kms.cloud.ibm.com` | | | `private.eu-gb.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:eu-gb:::endpoint:private.eu-gb.kms.cloud.ibm.com` | | | `private.eu-de.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:eu-de:::endpoint:private.eu-de.kms.cloud.ibm.com` | | | `private.au-syd.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:au-syd:::endpoint:private.au-syd.kms.cloud.ibm.com` | | | `private.jp-tok.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:jp-tok:::endpoint:private.jp-tok.kms.cloud.ibm.com` | | Washington | | | | | `private.us-south.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:us-south:::endpoint:private.us-south.kms.cloud.ibm.com` | | | `private.us-east.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:us-east:::endpoint:private.us-east.kms.cloud.ibm.com` | | | `private.eu-gb.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:eu-gb:::endpoint:private.eu-gb.kms.cloud.ibm.com` | | | `private.eu-de.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:eu-de:::endpoint:private.eu-de.kms.cloud.ibm.com` | | | `private.au-syd.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:au-syd:::endpoint:private.au-syd.kms.cloud.ibm.com` | | | `private.jp-tok.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:jp-tok:::endpoint:private.jp-tok.kms.cloud.ibm.com` | | Sydney | | | | | `private.us-south.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:us-south:::endpoint:private.us-south.kms.cloud.ibm.com` | | | `private.us-east.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:us-east:::endpoint:private.us-east.kms.cloud.ibm.com` | | | `private.eu-gb.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:eu-gb:::endpoint:private.eu-gb.kms.cloud.ibm.com` | | | `private.eu-de.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:eu-de:::endpoint:private.eu-de.kms.cloud.ibm.com` | | | `private.au-syd.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:au-syd:::endpoint:private.au-syd.kms.cloud.ibm.com` | | | `private.jp-tok.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:jp-tok:::endpoint:private.jp-tok.kms.cloud.ibm.com` | | Tokyo | | | | | `private.us-south.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:us-south:::endpoint:private.us-south.kms.cloud.ibm.com` | | | `private.us-east.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:us-east:::endpoint:private.us-east.kms.cloud.ibm.com` | | | `private.eu-gb.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:eu-gb:::endpoint:private.eu-gb.kms.cloud.ibm.com` | | | `private.eu-de.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:eu-de:::endpoint:private.eu-de.kms.cloud.ibm.com` | | | `private.au-syd.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:au-syd:::endpoint:private.au-syd.kms.cloud.ibm.com` | | | `private.jp-tok.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:jp-tok:::endpoint:private.jp-tok.kms.cloud.ibm.com` | | London | | | | | `private.us-south.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:us-south:::endpoint:private.us-south.kms.cloud.ibm.com` | | | `private.us-east.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:us-east:::endpoint:private.us-east.kms.cloud.ibm.com` | | | `private.eu-gb.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:eu-gb:::endpoint:private.eu-gb.kms.cloud.ibm.com` | | | `private.eu-de.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:eu-de:::endpoint:private.eu-de.kms.cloud.ibm.com` | | | `private.au-syd.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:au-syd:::endpoint:private.au-syd.kms.cloud.ibm.com` | | | `private.jp-tok.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:jp-tok:::endpoint:private.jp-tok.kms.cloud.ibm.com` | | Frankfurt | | | | | `private.us-south.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:us-south:::endpoint:private.us-south.kms.cloud.ibm.com` | | | `private.us-east.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:us-east:::endpoint:private.us-east.kms.cloud.ibm.com` | | | `private.eu-gb.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:eu-gb:::endpoint:private.eu-gb.kms.cloud.ibm.com` | | | `private.eu-de.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:eu-de:::endpoint:private.eu-de.kms.cloud.ibm.com` | | | `private.au-syd.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:au-syd:::endpoint:private.au-syd.kms.cloud.ibm.com` | | | `private.jp-tok.kms.cloud.ibm.com` | `crn:v1:bluemix:public:kms:jp-tok:::endpoint:private.jp-tok.kms.cloud.ibm.com` | {: caption="Table 1. VPE endpoints and CRNs for Key Protect" caption-side="bottom"}