---
title: Private connectivity
description: Private connectivity is a secure way for your Elastic Cloud deployments and projects to communicate with other cloud provider services over your cloud...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6338/deploy-manage/security/private-connectivity
products:
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Cloud Hosted: Generally available
---

# Private connectivity
Private connectivity is a secure way for your Elastic Cloud deployments and projects to communicate with other cloud provider services over your cloud provider's private network. You can create a virtual private connection (VPC) using your provider's private link service, and then manage it in Elastic Cloud using a private connection policy. You can also optionally filter traffic to your deployments and projects by creating ingress filters for your VPC in Elastic Cloud.
<note>
  Serverless Observability and Security projects must belong to a specific feature tier to apply private connection policies:
  - Observability: [Observability Complete](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6338/solutions/observability/observability-serverless-feature-tiers)
  - Security: [Security Analytics Complete](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6338/solutions/security/security-serverless-feature-tiers)
</note>

<tip>
  Private connection policies are a type of [network security policy](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6338/deploy-manage/security/network-security-policies).
</tip>


## Required permissions

The following organization-level roles are required to manage network security policies through the Elastic Cloud Console. For more information about roles and scoping, refer to [User roles and privileges](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6338/deploy-manage/users-roles/cloud-organization/user-roles).
<applies-switch>
  <applies-item title="ess:" applies-to="Elastic Cloud Hosted: Generally available">
    | Action                                                                         | Required role                                                       |
    |--------------------------------------------------------------------------------|---------------------------------------------------------------------|
    | View network security policies                                                 | Any organization member                                             |
    | Create a network security policy                                               | Organization ownerAdmin or Editor on at least one Hosted deployment |
    | Edit or delete a network security policy                                       | Organization ownerAdmin or Editor on at least one Hosted deployment |
    | Mark a network security policy to apply to new deployments by default          | Organization ownerAdmin or Editor scoped to all Hosted deployments  |
    | Associate or disassociate a network security policy with a specific deployment | Admin or Editor on that deployment                                  |
  </applies-item>

  <applies-item title="serverless:" applies-to="Elastic Cloud Serverless: Generally available">
    | Action                                                                      | Required role                                                                                       |
    |-----------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
    | View network security policies                                              | Any organization member                                                                             |
    | Create a network security policy                                            | Organization ownerAdmin or Editor on at least one project                                           |
    | Edit or delete a network security policy                                    | Organization ownerAdmin or Editor on at least one project                                           |
    | Mark a network security policy to apply to new projects by default          | Organization ownerAdmin or Editor scoped to all Elasticsearch, Observability, and Security projects |
    | Associate or disassociate a network security policy with a specific project | Admin or Editor on that project                                                                     |
  </applies-item>
</applies-switch>


## Available services

Choose the relevant option for your cloud service provider:

| Cloud service provider | Service                                                                                                                                           | Applicable deployment types      |
|------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------|
| AWS                    | [AWS PrivateLink](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6338/deploy-manage/security/private-connectivity-aws)             | Elastic Cloud Hosted, Serverless |
| Azure                  | [Azure Private Link](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6338/deploy-manage/security/private-connectivity-azure)        | Elastic Cloud Hosted             |
| GCP                    | [GCP Private Service Connect](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6338/deploy-manage/security/private-connectivity-gcp) | Elastic Cloud Hosted             |

For private connections created for Elastic Cloud Hosted deployments, after you set up your private connection, you can [claim ownership of your private connection ID](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6338/deploy-manage/security/claim-private-connection-api) to prevent other organizations from using it.
To learn how private connection policies work, how they affect your deployment or project, and how they interact with [IP filter policies](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6338/deploy-manage/security/ip-filtering-cloud), refer to [Network security policies in Elastic Cloud](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6338/deploy-manage/security/network-security-policies).
<tip>
  Elastic Cloud Hosted and Elastic Cloud Serverless also support [IP filters](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6338/deploy-manage/security/ip-filtering-cloud). You can apply both IP filters and private connections to a single Elastic Cloud resource.
</tip>

<note>
  Private connection policies were formerly referred to as PrivateLink traffic filters.
</note>