Skip to main content
Automated Setup Available: We now provide an automated script that simplifies the VPC endpoint creation process. For most users, we recommend using the AWS VPC Endpoint Automation Script instead of this manual process. This guide remains available for reference, troubleshooting, and those who prefer manual configuration. If you use the script, set dns.enabled: false in its configuration and create the sign-in hostname’s private hosted zone as described in Step 7.
This guide illustrates configuring an AWS Virtual PrivateLink (VPL) between your company VPC and Fiddler Cloud environment to establish secure communication channels.
Fiddler Customers must complete these steps only after the Fiddler team has completed the customer’s private-link-based environment deployment.

​
How It Works

Your Fiddler environment serves two hostnames, and both must resolve to your VPC endpoint’s private IP addresses through the DNS your clients use. Clients that use the VPC’s Amazon-provided DNS get this from the steps below. If your clients use your own DNS servers (a custom DHCP option set, on-premises, or VPN), forward queries for both hostnames to a Route 53 Resolver inbound endpoint in the VPC: AWS allows only one private DNS name per endpoint service, so the endpoint covers the application hostname and the sign-in hostname needs its own private hosted zone. Neither hostname resolves publicly, and both must be used exactly as provided: the TLS certificate, the sign-in service, and the SSO URLs are bound to these names, so a CNAME from your own domain will not work.
<customer-subdomain> is typically your company name. If you have specific subdomain requirements or restrictions, notify your Fiddler representative before VPL configuration.

​
Prerequisites

Send to Fiddler:
  • The AWS account ID of every account that will create an endpoint (for example, one per environment such as DEV and QA). Fiddler allowlists each account on the endpoint service. VPC and subnet IDs are not needed.
Receive from Fiddler:
  • The endpoint service name (com.amazonaws.vpce.<region>.vpce-svc-...)
  • Your two hostnames
  • The AWS region of your Fiddler environment
In your AWS account:
  • A VPC in the same region as your Fiddler environment
  • The VPC CIDR range
  • IAM permissions to create VPC endpoints, security groups, and Route 53 private hosted zones
  • DNS resolution and DNS hostnames enabled on the VPC (required for endpoint private DNS and private hosted zones)

​
Step 1: Navigate to the AWS VPC Console

  1. Log in to your AWS Management Console
  2. Navigate to the VPC service
  3. In the left navigation panel, click on “Endpoints”
  4. Click the Create endpoint button
Create an endpoint

​
Step 2: Configure the Fiddler Endpoint Service

  1. Enter a descriptive name tag for your endpoint
  2. Select “PrivateLink Ready partner services” from the service categories
  3. Enter the Fiddler-provided service name
  4. Click Verify Service to confirm the service details
Verification fails until Fiddler has allowlisted your AWS account. Contact your Fiddler representative if you haven’t received the service name or confirmation that your account is allowlisted.
Provide the endpoint service name

​
Step 3: Select VPC and Subnets

  1. Select your VPC from the dropdown
  2. Choose all subnets where your client applications are running
  3. Ensure the selected subnets have appropriate routing within your VPC to the endpoint
Select the VPC

​
Step 4: Configure Security Group

  1. Create a new security group if one doesn’t exist
  2. Add an inbound rule to allow:
    • Port: 443 (HTTPS)
    • Source: Your VPC CIDR range
  3. Select the security group ID to associate with the endpoint

​
Example security group configuration:

  • Inbound rule: TCP 443 from VPC CIDR
  • Outbound rule: All traffic (default)
Create a new security group

​
Step 5: Create the Endpoint

  1. Review all configuration settings
  2. Click Create endpoint to initiate the endpoint creation
  3. Wait for the endpoint status to change to “Available”

​
Step 6: Enable Private DNS for the Application Hostname

  1. Select the newly created endpoint
  2. From the Actions menu, choose “Modify private DNS name”
  3. Enable private DNS names by checking the “Enable for this endpoint” checkbox
  4. Click Save changes
AWS now resolves <customer-subdomain>.cloud.fiddler.ai to the endpoint inside this VPC. No hosted zone or record is needed for this hostname. Select action "Modify the private DNS name" Modify the private DNS name

​
Step 7: Create the Private Hosted Zone for the Sign-In Hostname

  1. In the Route 53 console, choose Hosted zones, then Create hosted zone
  2. Set Domain name to your sign-in hostname exactly: authn-<customer-subdomain>.cloud.fiddler.ai
  3. Set Type to Private hosted zone and associate the VPC that contains the endpoint
  4. Click Create hosted zone
  5. In the new zone, click Create record and configure:
    • Record name: leave blank (the zone apex)
    • Record type: A
    • Alias: enabled
    • Route traffic to: Alias to VPC endpoint, your region, then select the endpoint’s regional DNS name (the entry without an Availability Zone, vpce-<id>-<suffix>.vpce-svc-<id>.<region>.vpce.amazonaws.com)
  6. Click Create records
The record is an alias A record because the hostname is the zone apex, where DNS does not allow a CNAME.
Do not create a private hosted zone for cloud.fiddler.ai or fiddler.ai. A private zone takes over every name beneath it in the associated VPCs, so any *.cloud.fiddler.ai name not in that zone stops resolving from your network.

​
Step 8: Verify Configuration

From a host in the VPC:
  1. Both hostnames resolve to private IP addresses in your VPC:
  2. The sign-in service responds:
    A 200 confirms DNS, the security group, and the TLS certificate end to end.
  3. Open https://<customer-subdomain>.cloud.fiddler.ai in a browser and sign in.

​
Connecting Additional VPCs or Accounts

Repeat Steps 1–7 in each VPC that needs access, after sending Fiddler the AWS account ID if it is a new account. Every VPC gets its own endpoint, its own private DNS setting, and its own sign-in private hosted zone whose alias record points to that VPC’s endpoint. Do not associate another VPC’s sign-in zone: its record points to the other VPC’s endpoint. All endpoints connect to the same Fiddler environment.

​
Single Sign-On

If your organization signs in through SSO, your identity provider’s Fiddler application uses URLs on the sign-in hostname (https://authn-<customer-subdomain>.cloud.fiddler.ai/...). Configure them by following the guide for your provider, for example Microsoft Entra ID SAML.
If Fiddler moves you to a new environment with a different subdomain, the SSO URLs change with it. Fiddler provides the new Identifier (Entity ID) and Reply URLs; add them to your identity provider’s Fiddler application before the first sign-in on the new environment.

​
Troubleshooting

If the issue persists, contact Fiddler support with your endpoint ID, AWS account ID, and the output of the Step 8 checks.

​
Next Steps