Terraform module to establish a secure access channel through PrivateLink for bailian on Alibaba Cloud

terraform-alicloud-private-network-access-for-bailian

English | 简体中文

The official release of the DeepSeek R1 large model has garnered widespread attention from the global technology community. As a high-performance generative AI model that is both open-source and free to use, DeepSeek R1 has demonstrated core performance metrics comparable to GPT-o1 in several benchmark tests. Numerous developers and enterprise users have already begun technical validation and scenario adaptation work.
Alibaba Cloud's Bailian platform now offers public network API access to the DeepSeek model. However, while public network access provides convenience, its potential data security risks pose a significant challenge for enterprise-level applications, specifically in the following dimensions:

• Encryption Vulnerabilities in Transmission Links: Public network communication is susceptible to man-in-the-middle attacks, potentially compromising data transmission security.
• Risk of Request Log Retention: Traffic logs on third-party network nodes may lead to sensitive data leakage.
• Industry Compliance Requirements: Highly regulated sectors like finance, healthcare, and automotive have explicit compliance constraints regarding data transmission paths.

To meet the core data security and compliance demands of enterprise users, we recommend establishing a secure access channel through PrivateLink. This solution offers the following advantages:

• Establishes an end-to-end private network environment.
• Enables stable service invocation with millisecond-level latency.
• Meets industry regulatory compliance requirements.
• Provides auditable data flow path tracing.

Architecture Diagram:

Usage

provider "alicloud" {
  alias  = "local_region"
  region = "cn-beijing"
}

provider "alicloud" {
  alias  = "remote_region"
  region = "cn-shanghai"
}

module "complete" {
  source = "alibabacloud-automation/private-network-access-for-bailian/alicloud"

  providers = {
    alicloud.local_region  = alicloud.local_region
    alicloud.remote_region = alicloud.remote_region
  }

  local_vpc_config = {
    vpc = {
      vpc_name   = "beijing_vpc"
      cidr_block = "192.168.0.0/16"
    }
    vswitches = [{
      zone_id    = "cn-beijing-g"
      cidr_block = "192.168.1.0/24"
      }, {
      zone_id    = "cn-beijing-i"
      cidr_block = "192.168.2.0/24"
    }]
    tr_vpc_attachment = {
      transit_router_attachment_name        = "TR-Attachment-Beijing"
      transit_router_attachment_description = "Transit Router Attachment for Beijing Region"
    }
  }

  remote_vpc_config = {
    vpc = {
      vpc_name   = "shanghai_vpc"
      cidr_block = "10.0.0.0/16"
    }
    vswitches = [{
      zone_id    = "cn-shanghai-m"
      cidr_block = "10.0.1.0/24"
      }, {
      zone_id    = "cn-shanghai-n"
      cidr_block = "10.0.2.0/24"
    }]
    tr_vpc_attachment = {
      transit_router_attachment_name        = "TR-Attachment-Shanghai"
      transit_router_attachment_description = "Transit Router Attachment for Shanghai Region"
    }
  }
}

Examples

• Complete Example

Requirements

Name	Version
terraform	>= 1.3

Providers

Name	Version
alicloud	n/a
alicloud.local_region	n/a
alicloud.remote_region	n/a

Modules

Name	Source	Version
local_vpc	./modules/vpc	n/a
remote_vpc	./modules/vpc	n/a

Resources

Name	Type
alicloud_cen_instance.this	resource
alicloud_cen_transit_router.local	resource
alicloud_cen_transit_router.remote	resource
alicloud_cen_transit_router_peer_attachment.this	resource
alicloud_cen_transit_router_route_table_association.beijing_peer_attachment	resource
alicloud_cen_transit_router_route_table_association.shanghai_peer_attachment	resource
alicloud_cen_transit_router_route_table_propagation.beijing_peer_propagation	resource
alicloud_cen_transit_router_route_table_propagation.shanghai_peer_propagation	resource
alicloud_privatelink_vpc_endpoint.dashscope_endpoint	resource
alicloud_privatelink_vpc_endpoint_zone.this	resource
alicloud_pvtz_zone.dashscope_pvtz_zone	resource
alicloud_pvtz_zone_attachment.remote_vpc_attachment	resource
alicloud_pvtz_zone_record.dashscope_cname_record	resource
alicloud_security_group.this	resource
alicloud_security_group_rule.http_ingress_rule	resource
alicloud_security_group_rule.https_ingress_rule	resource
alicloud_cen_transit_router_route_tables.local	data source
alicloud_cen_transit_router_route_tables.remote	data source
alicloud_regions.remote	data source

Inputs

Name	Description	Type	Default	Required
cen_instance_config	The parameters of cen instance.	object({ cen_instance_name = optional(string, "main_cen_instance") description = optional(string, null) protection_level = optional(string, "REDUCED") })	{}	no
local_tr_config	The parameters of local transit router.	object({ transit_router_name = optional(string, "local-tr") transit_router_description = optional(string, null) })	{}	no
local_vpc_config	The parameters of local vpc resources. The attributes 'vpc', 'vswitches' are required.	object({ vpc = object({ cidr_block = string vpc_name = optional(string, null) }) vswitches = list(object({ zone_id = string cidr_block = string vswitch_name = optional(string, null) })) tr_vpc_attachment = optional(object({ transit_router_attachment_name = optional(string, null) transit_router_attachment_description = optional(string, null) auto_publish_route_enabled = optional(bool, true) }), {}) })	n/a	yes
privatelink_vpc_endpoint	The parameters of privatelink vpc endpoint.	object({ service_name = optional(string, "com.aliyuncs.dashscope") vpc_endpoint_name = optional(string, "pvltest_dashscope_endpoint") })	{}	no
pvtz_zone_name	The name of pvtz zone.	string	"vpc-cn-beijing.dashscope.aliyuncs.com"	no
pvtz_zone_record	The parameters of pvtz zone record.	object({ rr = optional(string, "@") type = optional(string, "CNAME") ttl = optional(number, 15) status = optional(string, "ENABLE") })	{}	no
remote_tr_config	The parameters of remote transit router.	object({ transit_router_name = optional(string, "remote-tr") transit_router_description = optional(string, null) })	{}	no
remote_vpc_config	The parameters of remote vpc resources. The attributes 'vpc', 'vswitches' are required.	object({ vpc = object({ cidr_block = string vpc_name = optional(string, null) }) vswitches = list(object({ zone_id = string cidr_block = string vswitch_name = optional(string, null) })) tr_vpc_attachment = optional(object({ transit_router_attachment_name = optional(string, null) auto_publish_route_enabled = optional(bool, true) }), {}) })	n/a	yes
security_group_config	The parameters of security group.	object({ security_group_name = optional(string, "main-security-group") description = optional(string, "for Privatelink") })	{}	no
tr_peer_attachment	The parameters of transit router peer attachment.	object({ transit_router_attachment_name = optional(string, "TR-Peer-Attachment") auto_publish_route_enabled = optional(bool, true) bandwidth_type = optional(string, "DataTransfer") bandwidth = optional(number, 10) })	{}	no

Outputs

Name	Description
cen_instance_id	The ID of the CEN instance
local_route_table_id	The ID of the local TR route table
local_transit_router_id	The ID of the local transit router
local_vpc_cidr_block	The CIDR block of the local VPC
local_vpc_id	The ID of the local VPC
local_vswitch_ids	The list of IDs of the local VSwitches
privatelink_endpoint_id	The ID of the PrivateLink VPC endpoint
pvtz_zone_id	The ID of the PrivateZone
pvtz_zone_record_id	The ID of the PrivateZone record
remote_route_table_id	The ID of the remote TR route table
remote_transit_router_id	The ID of the remote transit router
remote_vpc_cidr_block	The CIDR block of the remote VPC
remote_vpc_id	The ID of the remote VPC
remote_vswitch_ids	The list of IDs of the remote VSwitches
security_group_id	The ID of the security group

Submit Issues

If you have any problems when using this module, please opening a provider issue and let us know.

Note: There does not recommend opening an issue on this repo.

Authors

Created and maintained by Alibaba Cloud Terraform Team(terraform@alibabacloud.com).

License

MIT Licensed. See LICENSE for full details.

Reference

• Terraform-Provider-Alicloud Github
• Terraform-Provider-Alicloud Release
• Terraform-Provider-Alicloud Docs