Configuring AWS PrivateLink for Qlik Data Gateway - Direct Access

Last updated: 9/24/2026

This topic describes the AWS PrivateLink workflow for connecting a Direct Access gateway in your Amazon Web Services (AWS) VPC to Qlik Cloud through private connectivity on the AWS network.

Understand the pattern

The pattern uses an AWS interface VPC endpoint in your VPC to connect to a Qlik Cloud AWS endpoint service. The Direct Access gateway runs in your VPC. Route 53 private DNS can resolve the service name from the VPC, and traffic remains on the AWS backbone instead of traversing the public internet.

• Qlik provides and operates the Qlik Cloud endpoint service.
• You create and operate the interface VPC endpoint, private DNS, and network controls in your AWS account.
• You install and operate the Direct Access gateway in your VPC and keep its connection to your data sources available.

Check the scope

• This pattern applies to AWS and to Direct Access gateway connectivity to Qlik Cloud.
• Azure private connectivity is out of scope for this topic.
• Availability must be confirmed for the requested tenant and AWS Region before implementation.

Prepare your environment

Before implementation, coordinate with your AWS and Qlik Cloud administrators. Confirm the following for your tenant and AWS Region:

• The Direct Access gateway is installed on an EC2 instance, and the instance is running.
• You have AWS Console access with permission to create VPC endpoints and modify security groups.
• Qlik has confirmed PrivateLink availability for the tenant and region and has provided the exact regional service name and onboarding requirements.
• You can contact Qlik Support to provide the endpoint ID and request endpoint service acceptance.

Configure the workflow

Do the following with your AWS and Qlik Cloud administrators:

1. From the EC2 instance, identify the VPC where the Direct Access gateway runs.
2. In the AWS Console, go to VPC > PrivateLink and Lattice > Endpoints, and click Create endpoint.
3. Select the endpoint service option and enter the exact Qlik regional service name confirmed for your tenant.
4. Contact Qlik Support and share your AWS Account ID, and AWS region where the connection should be initiated from. Wait until Qlik Support confirms that Qlik has added your AWS Account ID.
5. Select the VPC identified for the EC2 instance. Leave Enable private DNS name clear until Qlik accepts the endpoint.
6. Select the subnet that matches the Availability Zone of the EC2 instance.
7. Assign a security group with inbound HTTPS on port 443. Set the source to the security group itself; do not use the subnet or an open IP range as the source.

8. Click Create endpoint.

   • On the Create endpoint page:

     • Enter a Name tag for the endpoint (e.g., dag-privatelink-test ).

     • Under Type, select Endpoint services that use NLBs and GWLBs.

   • Under Service settings:

     • Enter the Service name provided by Qlik for your region (e.g., com.amazonaws.vpce.us-east-1.vpce-svc-0afc69d0635aef748). For the list of service names by region, see List of service names (VPC IDs) per region.

     • Click Verify service. You should see a green "Service name verified" confirmation banner.

   • Select your VPC:

     • Under Network settings, click the VPC dropdown and select the VPC that matches your EC2 instance's VPC ID (e.g., vpc-0abc1234def56789a).

   Contact Qlik Support with the endpoint ID so Qlik can accept the endpoint service connection.
9. After Qlik accepts the endpoint, enable private DNS. Before enabling it, confirm that the VPC has Enable DNS hostnames and Enable DNS support enabled.

10. Enable the private connection on the gateway by running one of the following, depending on your deployment method:

    • Windows server installation:

      connectoragent qcs set_config --private_connection true --tenant_url https://<tenantName>.<region>.qlikcloud.com

      (Replace <tenantName> and <region> with the tenant values confirmed by Qlik.)

    • Containerized installation:

      dotnet ConnectorAgent.dll qcs set_config --private_connection true --tenant_url https://<tenantName>.<region>.qlikcloud.com

      (Replace <tenantName> and <region> with the tenant values confirmed by Qlik.)

11. Run a load script through the DAG connection and confirm the traffic through the endpoint service monitoring.

Validate and troubleshoot

First determine whether the issue is in the AWS endpoint path or in the Direct Access gateway application connection. Check endpoint state, private DNS resolution, routing, and security controls with your AWS administrator. Check gateway service status and logs with the Direct Access gateway administrator. For gateway-specific troubleshooting, see Configuring and troubleshooting Qlik Data Gateway - Direct Access.

List of service names (VPC IDs) per region

This section lists the service names corresponding to each region. You need the service name when configuring the AWS PrivateLink setup, as described in Configure the workflow.