Function Overview

VPC endpoints are secure and private channels for connecting VPCs to VPC endpoint services.

You can buy a VPC endpoint to connect a resource in your VPC to a VPC endpoint service in another VPC of the same region.

A VPC endpoint service is a cloud service or a private service that can be accessed through a VPC endpoint.

There are two types of VPC endpoint services: gateway and interface.

• Gateway VPC endpoint services are created only for cloud services.
• Interface VPC endpoint services can be created for both cloud services and your private services. All VPC endpoint services for cloud services are created by default while those for private services need to be created by users themselves.

Monitoring is key to ensuring performance, reliability, and availability of VPC endpoints. Cloud Eye helps you track statuses and performance of your VPC endpoints in real time.

After CTS is enabled, CTS starts recording operations on cloud resources. The CTS management console stores the last seven days of operation records.

This section describes how to query or export the last seven days of operation records on the management console.

Permission management controls the access of a VPC endpoint in one account to a VPC endpoint service in another.

After a VPC endpoint service is created, you can add an authorized account ID to or delete it from the whitelist of the endpoint service.

• If the whitelist is empty, access from a VPC endpoint in another account is not allowed.
• If an authorized account ID is already in the whitelist, you can use this account to create a VPC endpoint for connecting to the VPC endpoint service.
• If an authorized account ID is not in the whitelist, you cannot use this account to create a VPC endpoint for connecting to the VPC endpoint service.

The VPC endpoints for connecting to interface VPC endpoint services support access control. For a new or existing VPC endpoint, you can enable access control, add or delete a whitelist record, or disable access control if you do not need it.

To connect a VPC endpoint to a VPC endpoint service that has connection approval enabled, obtain the approval from the owner of the endpoint service.

Prerequisites: There is a VPC endpoint available for connecting to the target VPC endpoint service.

After a VPC endpoint service is created, you can view the added port mappings.

A port mapping defines the protocol and ports used for communications between a VPC endpoint and a VPC endpoint service.

• Protocol: A protocol both supported by the VPC endpoint and VPC endpoint service
• Service Port: A service port is provided by the backend service bound to the endpoint service.
• Terminal Port: A terminal port is provided by the VPC endpoint, allowing you to access the VPC endpoint service.

Tags are used to identify cloud resources. When you have many cloud resources of the same type, you can use tags to classify cloud resources by dimension (for example, use, owner, or environment).

TMS provides the following functions:

• Resource tag management: By adding tags to resources under your account, you can classify resources. TMS provides you with a visualized table to manage resource tags, including editing tags in batches.
• Resource tag search: You can search for resources of all services in all regions by tag or by combination of tags.
• Predefined tag management: You can create, import, or export predefined tags. By predefining tags, you can plan tags from the service perspective to effectively manage tags.

If you need to assign different permissions to employees in your enterprise to access your cloud resources, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to Huawei Cloud.

With IAM, you can use your Huawei Cloud account to create IAM users for your employees, and assign permissions to the users to control their access to specific Huawei Cloud resources. For example, you need to allow website maintenance personnel in your enterprise to use VPCEP resources but do not want them to delete other cloud resources or perform any high-risk operations. To achieve this result, you can create IAM users for the maintenance personnel and grant them only the permissions required for using VPCEP resources.

The VPCEP service provides extended RESTful APIs.

VPCEP APIs allow you to use all VPCEP functions. VPCEP has two types of resources: VPC endpoints and VPC endpoint services.

The following table lists the APIs provided by VPCEP.

With the VPCEP SDKs, you can easily invoke VPCEP APIs to create Internet-based applications on HUAWEI CLOUD.
Currently, SDKs support Java, Python, and Go languages. You can use APIs or any other well-known SDKs.