Hello, my name is Courtney Dascenzo,
and I'm a Product Manager within Platform,
and today I'm here to introduce Salesforce Private Connect.
Salesforce Private Connect keeps communications private
by allowing for bidirectional connections
between Salesforce and our launch partner, AWS.
To do this, Salesforce is deploying
a managed private connection.
Think of this like a VPN service between
Salesforce first-party data centers and AWS regions.
Within the region, Salesforce deploys
a managed transit VPC, or virtual private cloud.
Customers who are running VPCs within the same region
can connect to the managed service
through an AWS feature called PrivateLink.
Today I'm going to demonstrate how to
create, provision, and tear down PrivateLinks
from within the Salesforce setup experience.
Within a Summer '20 org, under the Security node in Setup,
is a feature called Private Connect.
Private Connect allows for inbound connections,
that is where the traffic originates in AWS
and flows into Salesforce,
or outbound connections, where traffic
originates in Salesforce and flows out to AWS services.
I'm going to demonstrate how to
create an outbound connection.
To do this, I need to expand my regions.
This shows me which AWS regions this org has access to.
To create an outbound connection,
I need to whitelist the IAM role in my endpoint service.
Within my endpoint service, in my customer VPC,
I need to go to my whitelisted principals.
I need to add to the whitelisted principals
the IAM role I copied.
This allows the Salesforce managed service
to talk to this customer endpoint service.
Once that is available, I need to
take the service name and copy it.
Now I can go create my outbound connection.
So from within Salesforce,
I click Create Outbound Connection.
It defaults to the AWS PrivateLink.
I give my outbound connection a name,
I paste in the service endpoint
and I select the region I want this to run in.
I'm going to select
"No, I want to provision this connection later".
By selecting No,
it does not automatically provision an endpoint,
and leaves it in a status of Unprovisioned.
Now I can provision this at my convenience.
I'm going to go ahead and click Actions
and click Provision to provision this endpoint.
You'll notice that it's allocating an endpoint
at the moment.
To get the latest status, I need to click Actions, Sync.
Here you can see an endpoint
was created in the Salesforce managed service
in a Pending Acceptance state.
In order to accept this, I need to go back into AWS Console.
Under Endpoint Connections, you will find my endpoint.
Here, I have to accept it.
Once it's accepted, it can take five to 10 minutes
before the connection becomes available for use.
In the meantime, I have another outbound connection
already available, my Summer20West.
I'll demonstrate how we can leverage Summer20West
within the Salesforce environment.
To do this, I need to use a name credential.
I have a name credential pointing to a private API
in my inventory database inside of AWS.
Notice the new lookup field
called Outbound Network Connection,
and it's pointing at our Summer20West private connection.
Anytime I make a call out from within Salesforce,
leveraging this name credential,
it will route through the private connection
instead of the public proxy.
To demonstrate this, I can show you through an HTTP request,
calling that name credential and doing a GET.
If I open up the log, you will now see
that the call out was successful with a 200,
and we are hitting that URL endpoint
that's in my name credential.
This is a private API.
If I try to open this in Postman,
and try to do the same call,
I get a "Could not get any response" error.
That's because the API
is not exposed to the public Internet,
and only available through my private connection.
Speaking of private connections,
let's see what the status of my private connection is.
If I sync, you'll notice it's in a Ready state.
I can now send traffic through this connection.
However, I would like to tear this down
because I no longer need it.
From the Actions menu, I click Tear Down.
I'll see a tear down in progress.
To get the latest status, I need to sync yet again.
Now that it's in an Unprovisioned state,
I can either reprovision this,
which will create a new PrivateLink,
or I can go ahead and delete this.
So, from within Salesforce, I have now demonstrated
how to create, provision, tear down, and delete PrivateLinks
using a feature in Summer20 called
Salesforce Private Connect.
If you are a developer,
private connections are available
through the metadata API in Salesforce DX,
as well as in the Salesforce CLI.
Lastly, the pilot is still available until mid-July,
so reach it you are interested in participating.
Thank you.