RC: Document connecting to PrivateLink from on-premises

[mich-elle-luna]

The guide only covered consumers inside the consumer VPC and didn't explain that the console's public endpoint hostname resolves to the Redis-managed VPC address outside that VPC by design. A customer connecting from on-premises over Direct Connect read this as PrivateLink being broken (Zendesk 169592). Add a note on what the hostname resolves to and why, plus a "Connect from on-premises" section covering the resource endpoint's default DNS name, a CNAME to the public endpoint hostname, and a Route 53 Resolver inbound endpoint, with the TLS certificate-verification requirement that decides between them.

---

Note

Low Risk
Documentation-only changes to the PrivateLink guide with no product or security code impact.

Overview
Expands the AWS PrivateLink guide so customers don't misread console hostnames as broken PrivateLink when connecting from outside the consumer VPC (e.g. on-premises over Direct Connect/VPN).

Adds a note after the in-VPC connection steps explaining that the console shows the database public endpoint, which normally resolves to the Redis-managed VPC address and is only overridden inside the consumer VPC by AWS's private hosted zone. From elsewhere, that same hostname still resolves—but to an unreachable address—so readers should use private-dns-entry in-VPC or follow the new on-premises section.

Introduces Connect from on-premises, framed by TLS certificate hostname requirements (Redis certs match the public endpoint hostname, not AWS PrivateLink DNS names). Documents three options: connect with the resource endpoint's default DNS name (no TLS), a CNAME from the public hostname to that default name (TLS-friendly), or a Route 53 Resolver inbound endpoint with conditional forwarding (AWS-native, higher cost).

^{Reviewed by Cursor Bugbot for commit 0e3db61. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

DOC-7024

[github-actions]

🧠 Redis Memory

Found 8 related items from repository history:

• PR — Update privatelink limitations for GA

• PR — RC: Remove PrivateLink UI

• PR — DOC-6845: Add MongoDB Atlas Private Link tab to Cloud RDI setup guide

  Documents the two-way handshake flow for connecting a MongoDB Atlas source database to Cloud RDI via Private Link: get the Atlas endpoint se

• Issue — Redis Cloud UI PrivateLink - Read More Link is 404

  Cloud UI -> subscription -> PRO-xxx-> connectivity -> privateLink-> Read More -> 404 not found

• Commit — Checking with @joniredis to make sure we can expose PrivateLink endpoints in docs right now.

  Checking with @joniredis to make sure we can expose PrivateLink endpoints in docs right now.

• Commit — Document connecting to PrivateLink from on-premises

  Document connecting to PrivateLink from on-premises

• PR — RC: Change PrivateLink screenshots for GA

• PR — Update PrivateLink docs for GA

Memory updated at 0e3db61

[github-actions]

Staging links:
https://redis.io/docs/staging/DOC-7024/operate/rc/security/aws-privatelink/

[andy-stark-redis]

Some minor (ignorable) suggestions but otherwise LGTM.