[Yandex Cloud documentation](../../index.md) > [Yandex Virtual Private Cloud](../index.md) > [Step-by-step guides](index.md) > Service connections > Creating a service connection

# Creating a service connection


To create a service connection, you need one of the following [roles](../security/index.md#roles-list): 

* `vpc.privateEndpoints.editor`
* `vpc.privateEndpoints.admin`
* `vpc.privateAdmin`
* `vpc.admin`
* `admin`

To create a [service connection](../concepts/private-endpoint.md):

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), navigate to the folder where you want to set up a service connection.
  1. Navigate to **Virtual Private Cloud**.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/globe.svg) **Service connections**.
  1. Click **Create connection**.
  1. In the **Name** field, enter a name for the service connection. Make sure to follow these naming requirements:
  
       * Length: between 3 and 63 characters.
       * It can only contain lowercase Latin letters, numbers, and hyphens.
       * It must start with a letter and cannot end with a hyphen.
  
  1. Optionally, in the **Description** field, add a description.
  1. Optionally, add [labels](../../storage/concepts/tags.md):
  
     1. Click **Add label**.
     1. Add a label in `key: value` format.
     1. Press **Enter**.
  
  1. Under **Network settings**:
  
     1. In the **Network** field, specify a network for the new service connection.
     1. To assign a random private IP address, select `Automatic` in the **Address** field.
     1. To reserve a list of IP addresses:
     
        1. In the **IP address** field, select `List`.
        1. Click **Reserve**.
        1. In the window that opens:
  
           * Specify a name and description for the IP address.
           * Select a [subnet](../concepts/network.md#subnet).
           * Assign an internal IPv4 address, e.g., `172.16.0.3`.
           * Enable **Deletion protection** for the address to be immune from deletion until you disable protection.
           * Add labels.
           * Click **Create**.
           * Repeat these steps to reserve additional IP addresses.
  
     1. In the **Service** field, select **Object Storage**.
     1. Optionally, enable **Create primary DNS record** to automatically create an additional DNS A record for the service's public [FQDN](../concepts/address.md#fqdn). The record will contain the internal IP address allocated to the service connection.
  
        Depending on whether the parameter is enabled, the following resource records will be created automatically for access to Object Storage:
        * The parameter is not used:
        
          Name | Type | Value
          --- | --- | ---
          storage.pe.yandexcloud.net | A | <internal_IP_address_of_service_connection>
          *.storage.pe.yandexcloud.net | A | <internal_IP_address_of_service_connection>
        
        * The parameter is used:
        
          Name | Type | Value
          --- | --- | ---
          storage.pe.yandexcloud.net | A | <internal_IP_address_of_service_connection>
          *.storage.pe.yandexcloud.net | A | <internal_IP_address_of_service_connection>
          storage.yandexcloud.net | A | <internal_IP_address_of_service_connection>
          *.storage.yandexcloud.net | A | <internal_IP_address_of_service_connection>
  
  1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).
  
  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.
  
  1. View the description of the CLI command to create a service connection:
  
      ```bash
      yc vpc private-endpoint create --help
      ```
  
  1. Create a service connection to Object Storage in the default folder:
  
      ```bash
      yc vpc private-endpoint create \
        --name <service_connection_name> \
        --description "<service_connection_description>" \
        --network-name <network_name> \
        --object-storage 
      ```
  
      Where:
  
      * `--name`: (Optional) Service connection name.
      * `--description`: (Optional) Service connection description.
      * `--network-name`: Name of the [cloud network](../concepts/network.md#network) the service connection will be created in. You can also use the [network ID](network-get-info.md) in the `--network-id` parameter.
      * `--object-storage`: Service connection to Object Storage. Other service connection types are not available yet.
  
      When creating a service connection, you can use the following additional parameters:
  
      * `--address-spec`: (Optional) Parameters in the `key=value` format for the internal IP address which will be assigned to the service connection:
        * `address`: (Optional) Private IP address for the service connection. If no IP address is provided, a random one will be assigned from the specified subnet’s range.
        * `subnet-id`: (Optional) [ID of the subnet](subnet-get-info.md) to provide an IP address for the service connection. If no subnet ID is provided, a random internal IP address will be assigned from the range of one of the subnets in the cloud network.
  
          {% note info %}
  
          To create a service connection, you should have at least one subnet in your network.
  
          {% endnote %}
  
      * `--private-dns-records-enabled`: (Optional) Parameter to create additional DNS [resource records](../../dns/concepts/resource-record.md) to override the public FQDN of the service to which the connection is created.
  
        Depending on whether the parameter is enabled, the following resource records will be created automatically for access to Object Storage:
        * The parameter is not used:
        
          Name | Type | Value
          --- | --- | ---
          storage.pe.yandexcloud.net | A | <internal_IP_address_of_service_connection>
          *.storage.pe.yandexcloud.net | A | <internal_IP_address_of_service_connection>
        
        * The parameter is used:
        
          Name | Type | Value
          --- | --- | ---
          storage.pe.yandexcloud.net | A | <internal_IP_address_of_service_connection>
          *.storage.pe.yandexcloud.net | A | <internal_IP_address_of_service_connection>
          storage.yandexcloud.net | A | <internal_IP_address_of_service_connection>
          *.storage.yandexcloud.net | A | <internal_IP_address_of_service_connection>
  
  1. Make sure the service connection is created:
  
      ```bash
      yc vpc private-endpoint list
      ```
      
      Result:
  
      ```text
      +----------------------+-------------+--------------------------------+
      |          ID          |    NAME     |          DESCRIPTION           |
      +----------------------+-------------+--------------------------------+
      | enpd7rq************* | s3-vpc-link | Private Endpoint to the Object |
      |                      |             | Storage                        |
      +----------------------+-------------+--------------------------------+
      ```

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).
  
  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.
  
  1. In the Terraform configuration file, describe the resources you want to create:
  
     ```hcl
     resource "yandex_vpc_private_endpoint" "my-vpc-endpoint" {
       name        = "<service_connection_name>"
       description = "<service_connection_description>"
       network_id  = "<cloud_network_ID>"
       
       # Service connection to Object Storage
       object_storage {}
  
       # Creating additional DNS resource records 
       dns_options {
         private_dns_records_enabled = <true_or_false>
       }
  
       endpoint_address {
         subnet_id = "<subnet_ID>"
       }
     }
     ```
  
     Where:
     * `name`: Service connection name. This is an optional parameter.
     * `description`: Service connection description. This is an optional parameter.
     * `network_id`: Name of the [cloud network](../concepts/network.md#network) the service connection will be created in. This is a required parameter.
     * `object_storage`: Service connection to Object Storage. Other service connection types are not available yet.
     * `dns_options`: Section with parameters for creating DNS records:
         * `private_dns_records_enabled`: Parameter to create additional DNS resource records to override the public FQDN of the service to which the connection is created. This is an optional parameter.
  
             Depending on whether the parameter is enabled, the following resource records will be created automatically for access to Object Storage:
             * The parameter is not used:
             
               Name | Type | Value
               --- | --- | ---
               storage.pe.yandexcloud.net | A | <internal_IP_address_of_service_connection>
               *.storage.pe.yandexcloud.net | A | <internal_IP_address_of_service_connection>
             
             * The parameter is used:
             
               Name | Type | Value
               --- | --- | ---
               storage.pe.yandexcloud.net | A | <internal_IP_address_of_service_connection>
               *.storage.pe.yandexcloud.net | A | <internal_IP_address_of_service_connection>
               storage.yandexcloud.net | A | <internal_IP_address_of_service_connection>
               *.storage.yandexcloud.net | A | <internal_IP_address_of_service_connection>
  
     * `endpoint_address`: Section with parameters of the service connection's internal IP address:
         * `subnet_id`: ID of the subnet to provide an IP address for the service connection. If no subnet ID is provided, a random internal IP address will be assigned from the range of one of the cloud network's subnets. This is an optional parameter.
  
        {% note info %}
  
        To create a service connection, you should have at least one subnet in your network.
  
        {% endnote %}
  
     For more information about `yandex_vpc_private_endpoint` properties, see [this provider guide](../../terraform/resources/vpc_private_endpoint.md).
  
  1. Create the resources:
  
     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.
  
     Terraform will create all the required resources. You can check the new resources using the [management console](https://console.yandex.cloud) or this [CLI](../../cli/index.md) command:
  
     ```bash
     yc vpc private-endpoint list
     ```

- API {#api}

  To create a [service connection](../concepts/private-endpoint.md), use the [create](../privatelink/api-ref/PrivateEndpoint/create.md) REST API method for the [PrivateEndpoint](../privatelink/api-ref/PrivateEndpoint/index.md) resource or the [PrivateEndpointService/Create](../privatelink/api-ref/grpc/PrivateEndpoint/create.md) gRPC API call.

{% endlist %}

#### See also {#see-also}

* [Getting information about a service connection](private-endpoint-get-info.md)
* [Deleting a service connection](private-endpoint-delete.md)