---
schema_version: "1"
id: 74e5b75c8985633b0f2e5b0e838ef11426aa3aebca2e4c444d44c4526f54bc1e
title: Add a Private Network Route for Amazon MSK
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/data/264-0-0/c360_a_private_connect_add_pnr_amazon_msk.md
canonical_url: https://help.salesforce.com/s/articleView?id=data.c360_a_private_connect_add_pnr_amazon_msk.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: a9364e2611c7c43990d82a688a33973fcdfa5fa4d0b67bdd6f345a0abcb7ceb6
description: Connect your Amazon Managed Streaming for Apache Kafka (MSK) data source and your Data Cloud tenant with a dedicated network connection using Private Connect for Data Cloud. You can create a single connection to a specific instance regardless of how many Data Cloud instances you have. Before setting up a connection for Amazon MSK, establish a private network route.
products:
  - Data 360
release: "264"
---
# Add a Private Network Route for Amazon MSK

Connect your Amazon Managed Streaming for Apache Kafka (MSK) data source and your Data Cloud tenant with a dedicated network connection using Private Connect for Data Cloud. You can create a single connection to a specific instance regardless of how many Data Cloud instances you have. Before setting up a connection for Amazon MSK, establish a private network route.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All Editions</strong> supported by Data 360. See <a href="https://help.salesforce.com/s/articleView?id=data.c360_a_dc_editions.htm&amp;release=264.0.0&amp;type=5" title="Data 360 is available in several supported Salesforce editions. Some Data 360 features also require additional licenses.">Data 360 edition availability</a>.</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d109497e69">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d109497e69 ">To create a Amazon MSK network route:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d109497e69 ">
              <p>Data Cloud Architect permission set OR</p>
              <p style="margin-bottom:0;">Manage External Connections or Customize
                Application permissions</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d109497e69 ">To administer an MSK environment:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d109497e69 ">Amazon MSK account administrator</td>

          </tr>
        </tbody>
      </table>

- The number of private network routes for a particular Amazon MSK connection per Data Cloud functional domain (not per Data Cloud org) is limited to one.
- You can configure a PNR to connect to an Amazon MSK instance, even if it isn't in the same region as your Data Cloud tenant.
- See the Amazon Web Services (AWS) Data Blog section “Pattern 2: Front all MSK brokers with a single shared interface endpoint” for more information. [How Goldman Sachs builds cross-account connectivity to their Amazon MSK clusters with AWS PrivateLink](https://aws.amazon.com/blogs/big-data/how-goldman-sachs-builds-cross-account-connectivity-to-their-amazon-msk-clusters-with-aws-privatelink/).

1. From the **App Launcher**, select **Data Cloud**.
2. From **Setup**, select **Data Cloud Setup**.
3. From **Data Cloud Setup**, expand **Admin Tools** and select **Private Connect**.
4. Click **New**.
    
    When the maximum number of licensed private network routes is reached, the New button doesn’t appear.
5. On the Add Private Network Route page, select **Amazon MSK** and click **Setup**.
6. The Configure Amazon MSK Private Network Route page provides the principle ID, which identifies the Salesforce AWS environment where this private network route will be created.
7. Enter a route name. The route API name is auto-populated. You can’t change the route name after you save it.
8. Go to the Amazon VPC Console by navigating to [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/).
9. In the navigation pane, locate and choose Endpoint services.
10. Enter the Broker Endpoints. Broker endpoints are the addresses used to connect to your cluster. From your MSK cluster in the AWS Management Console, navigate to the client information section to display the broker endpoints. For more information, see [Get the bootstrap brokers using the AWS Management Console](https://docs.aws.amazon.com/msk/latest/developerguide/get-bootstrap-console.html).
11. Copy the value of the Principal Id field in the PNR, and use the AWS console to add it to the list of allowed principals for your endpoint service.
12. Click **Save**.

Once your Private Connect connection is configured, allow a few minutes for it to become fully established before sending or receiving data.

#### See Also

- [_Salesforce Developers_: Create an Amazon Kafka Data Stream](https://developer.salesforce.com/docs/data/data-cloud-int/guide/c360-a-create-amazonkafka-data-stream)
- [_Salesforce Developers_: Set Up an Amazon Kafka Connection](https://developer.salesforce.com/docs/data/data-cloud-int/guide/c360-a-set-up-amazonkafka-connection)