AWS PrivateLink Connectivity
Connect to zerohash over AWS PrivateLink instead of the public internet
Overview
Platforms running in AWS can reach zerohash over AWS PrivateLink rather than the public internet, in both directions. PrivateLink is available for institutional integrations and is configured per platform. Contact your zerohash representative to start the process.
A PrivateLink integration is made up of one or more independent connection shapes. Each shape has a direction, and the side that receives the traffic publishes the VPC Endpoint Service.
| Traffic | Direction | Publishes the endpoint service | Consumes it |
|---|---|---|---|
| REST API (custody, payments) | Platform → zerohash | zerohash | Platform |
| FIX Gateway (Order Entry and Market Data) | Platform → zerohash | zerohash | Platform |
| Outbound webhooks (event notifications) | zerohash → Platform | Platform | zerohash |
For the REST API and FIX Gateway, zerohash publishes a VPC Endpoint Service and your platform creates an Interface VPC Endpoint against it. For outbound webhooks the roles reverse: your platform publishes the endpoint service and zerohash connects to it.
Each shape is stood up and validated in Cert first, with Prod following after Cert validation.
Before you start
Have the following ready before the joint setup session with zerohash:
- The AWS Account ID(s) you will connect from, per environment (Cert and Prod, if different). zerohash adds these as allowed principals on its endpoint services.
- The target region and Availability Zone details, if relevant to your setup.
- Whether you need a DR path in addition to the primary region.
- For outbound webhooks: your VPC Endpoint Service name or ID, its region, and the hostname and port zerohash should target.
Connection shape 1 - REST API
Your platform connects to zerohash. zerohash publishes an Interface VPC Endpoint Service, fronted by AWS WAF, and provides the endpoint service name and private DNS name per environment.
| Environment | Region | Port |
|---|---|---|
| Cert - Primary | us-east-2 | 443 |
| Cert - DR | us-west-2 | 443 |
| Prod - Primary | us-east-2 | 443 |
| Prod - DR | us-west-2 | 443 |
You provide: AWS Account ID(s) you will connect from, for Cert and Prod if different, to be added as allowed principals.
zerohash provides: the endpoint service name, the private DNS name, and confirmation once your account has been allowed.
Connection shape 2 - FIX Gateway (Order Entry and Market Data)
Order Entry and Market Data are separate endpoint services, requested per environment. The model is the same as the REST API: zerohash publishes, your platform consumes.
| Environment | Gateway | Region | Private DNS name | Port |
|---|---|---|---|---|
| Cert - Primary | Order Entry | us-east-2 | <partner-code>.oe.cert.zerohash.com | 13010 |
| Cert - Primary | Market Data | us-east-2 | <partner-code>.md.cert.zerohash.com | 13010 |
| Cert - DR | Order Entry | us-west-2 | Provided on request | 13010 |
| Cert - DR | Market Data | us-west-2 | Provided on request | 13010 |
| Prod - Primary | Order Entry | us-east-2 | <partner-code>.oe.zerohash.com | 13010 |
| Prod - Primary | Market Data | us-east-2 | <partner-code>.md.zerohash.com | 13010 |
| Prod - DR | Order Entry | us-west-2 | Provided on request | 13010 |
| Prod - DR | Market Data | us-west-2 | Provided on request | 13010 |
<partner-code> is your platform identifier, assigned by zerohash during onboarding.
DR infrastructure already exists in us-west-2. Standing up the FIX gateway and its load balancer there is the remaining step, done when DR is needed for a given platform, so raise DR requirements during the setup session.
You provide: AWS Account ID(s) per environment, plus Availability Zone preferences if you have them.
zerohash provides: the endpoint service names, private DNS names, and the Availability Zones each load balancer spans, so you can match them on your side.
Connection shape 3 - Outbound webhooks (zerohash → platform)
This shape is the reverse of the other two. Your platform publishes the VPC Endpoint Service, backed by your own receiving infrastructure, and zerohash consumes it.
You provide: your VPC Endpoint Service name or ID, its region, and the hostname and port zerohash should target.
zerohash provides: the zerohash AWS Account ID(s), for Cert and Prod, for you to add as allowed principals on your endpoint service.
Cert is validated before any production webhook traffic uses this path.
The zerohash webhook delivery path blocks destination URLs that resolve to private IP addresses. Your approved private IP(s) need an allowlist entry before outbound delivery over PrivateLink will work. Confirm this is in place during Cert validation.
Next steps
- Exchange AWS Account IDs in both directions ahead of the joint setup session.
- Stand up and validate the applicable connection shapes in Cert.
- Joint testing session: connectivity, DR failover if applicable, and webhook delivery.
- Repeat in Prod following the same validated shapes.
Updated about 1 hour ago