> ## Documentation Index
> Fetch the complete documentation index at: https://docs.omni.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect to ClickHouse Cloud with AWS PrivateLink

> Connect Omni to a ClickHouse Cloud service on AWS over a private network using a VPC endpoint.

<Note>
  This guide applies only to **ClickHouse Cloud** services on AWS. For self-hosted ClickHouse in your own AWS network, follow the [AWS PrivateLink guide](/connect-data/aws-privatelink).
</Note>

Omni can connect to your ClickHouse Cloud service on Amazon Web Services (AWS) via PrivateLink. In this configuration, Omni establishes an encrypted connection from our network to ClickHouse Cloud over a private network using a VPC endpoint.

## Requirements

To follow the steps in this guide, you'll need **Organization Admin** permissions in Omni, plus the following in ClickHouse Cloud:

* A service deployed on AWS
* Permissions that allow you to view the service's PrivateLink settings and manage private endpoints for your organization

### Regions

Your ClickHouse Cloud service doesn't have to be in the same region as your Omni instance.

However, PrivateLink isn't available in `ap-east-2` and `mx-central-1` regions. These regions don't support cross-region PrivateLink, and Omni has no AWS environment in either region.

## Setup

<Steps>
  <Step title="Retrieve your ClickHouse PrivateLink details" titleSize="h3">
    Omni needs two values from your ClickHouse Cloud service:

    * **VPC Endpoint Service** (`endpointServiceId`), which starts with `com.amazonaws.vpce`
    * **Private DNS hostname** (`privateDnsHostname`), which looks like `abc123.eu-west-1.vpce.aws.clickhouse.cloud`

    You can find both in the ClickHouse Cloud console under the service's **Settings**, or by calling the ClickHouse Cloud API.
  </Step>

  <Step title="Contact Omni support" titleSize="h3">
    Contact Omni support with the following information:

    * The VPC endpoint service name, for example `com.amazonaws.vpce.eu-west-1.vpce-svc-XXXXXXXXXX`
    * The private DNS hostname, for example `abc123.eu-west-1.vpce.aws.clickhouse.cloud`
    * The AWS region where your ClickHouse Cloud service is deployed
    * The port your service will be listening on, typically `8443`
    * Technical contact details, in case of connection difficulties
  </Step>
</Steps>

## What's next?

We will need you to authorize Omni's endpoint **after** we create it. The endpoint ID doesn't exist until then, so there's nothing to add to ClickHouse before you contact us.

1. Omni creates the VPC endpoint and sends you the endpoint ID, which starts with `vpce-`.

2. Register the endpoint ID for your ClickHouse Cloud organization.

3. Add the registered endpoint to the private endpoint allowlist of each ClickHouse service Omni should reach. In the ClickHouse Cloud console, this is under the service's **Settings > Set up private endpoint**.

4. Omni finishes wiring up the connection and adds it to your Omni instance.

<Warning>
  The endpoint must be added at both the organization level and the service level. Organization-level registration alone doesn't grant access to any service, and adding it only at the service level isn't sufficient. The connection fails until you complete both steps.
</Warning>

Once this is complete, the connection can be used like any other database connection. You'll need to provide your [ClickHouse authentication credentials](/connect-data/setup/clickhouse#setup) when setting up the connection in Omni.

## References

* [ClickHouse Cloud - AWS PrivateLink](https://clickhouse.com/docs/manage/security/aws-privatelink)