> ## Documentation Index
> Fetch the complete documentation index at: https://cockroachlabs.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Private Clusters

export const InternalLink = ({version, path = "", children, ...props}) => {
  let detectedVersion = version || "stable";
  if (typeof window !== 'undefined' && !version) {
    const match = window.location.pathname.match(/\/docs\/([^/]+)/);
    if (match) {
      detectedVersion = match[1];
    }
  }
  const normalizedPath = path.startsWith("/") ? path.slice(1) : path;
  return <a href={`/docs/${detectedVersion}/${normalizedPath}`} {...props}>
      {children}
    </a>;
};

Limiting access to a CockroachDB cluster's nodes over the public internet is an important security practice and is also a compliance requirement for many organizations. Private clusters on CockroachDB Advanced help organizations to meet this objective.

By default, CockroachDB Cloud has safeguards in place to protect cluster's data from the public internet.

* Ingress traffic to a cluster is routed through a load balancer, and it is possible to restrict inbound connections using a combination of <InternalLink path="network-authorization#ip-allowlisting">IP allowlisting</InternalLink> and <InternalLink path="connect-to-your-cluster#establish-private-connectivity">private connectivity</InternalLink>.
* Egress traffic from a cluster, such as <InternalLink version="stable" path="export">exports</InternalLink>, <InternalLink version="stable" path="backup">backups</InternalLink>, and <InternalLink version="stable" path="change-data-capture-overview">Change Data Capture (CDC)</InternalLink>, use public subnets by default.

A CockroachDB Advanced cluster with <InternalLink path="create-an-advanced-cluster">advanced security features enabled</InternalLink> is a *private cluster*. Its nodes have no public IP addresses, and egress traffic moves over private subnets and through a highly-available NAT gateway that is unique to the cluster.

A private cluster has one private network per cluster region, and each node is connected to the private network for its region. A NAT gateway is connected to each private network and provides a static egress public IP address.

Egress traffic from the cluster nodes to S3 or Google Cloud Storage flows across the private subnet and through the cloud provider's private network. Egress traffic from the cluster nodes to all other external resources flows across the private subnet and through the NAT gateway.

This page shows how to create a private cluster.

<Note>
  Private clusters are not available for <InternalLink path="cockroachdb-advanced-on-azure">CockroachDB Advanced on Azure</InternalLink>.
</Note>

## Create a private cluster

On GCP, new CockroachDB Advanced clusters are private by default. On AWS, newly CockroachDB Advanced with advanced security features clusters deployed on AWS are private by default.

Creation of private clusters, as well as Cloud clusters in general, requires the <InternalLink path="authorization#cluster-admin">Cluster Admin</InternalLink> or <InternalLink path="authorization#cluster-creator">Cluster Creator</InternalLink> role.

<Note>
  An existing cluster can't be migrated in-place to a private cluster.
</Note>

## Limit inbound connections from egress operations

Egress traffic from a private cluster to non-cloud external resources will always appear to come from the static IP addresses that comprise the cluster's NAT gateway. To determine the NAT gateway's IP addresses, you can initiate an egress operation such as an <InternalLink version="stable" path="export">`EXPORT`</InternalLink> or <InternalLink version="stable" path="backup">`BACKUP`</InternalLink> operation on the cluster and observe the source addresses of the resulting connections to your non-cloud external resources. Cockroach Labs recommends that you allow connections to such resources only from those IP addresses.

## What's next?

* <InternalLink path="security-overview">Security Overview</InternalLink>
* <InternalLink path="network-authorization">Network Authorization</InternalLink>
* <InternalLink path="egress-perimeter-controls">Egress Perimeter Controls</InternalLink>

## Limitations

* An existing cluster can't be migrated in-place to a private cluster. Instead, migrate the existing cluster's data to a new private cluster. Refer to <InternalLink version="molt" path="migration-overview">Migrate Your Database to CockroachDB</InternalLink>.