InboundNetworkConnection in SFDX

Architectural Overview#

InboundNetworkConnection represents an inbound private network connection managed under Salesforce Private Connect. Modern enterprise cloud architectures require zero-trust network topology where integration traffic between public clouds (e.g., AWS, Azure) and Salesforce never traverses the public internet.

Using InboundNetworkConnection, architects establish an AWS VPC endpoint connection or Azure Private Link endpoint directly into the Salesforce multi-tenant infrastructure. External microservices can invoke Salesforce REST or GraphQL APIs over private IP addresses, satisfying stringent financial and healthcare data security regulations.

Directory and File Conventions#

InboundNetworkConnection files reside in inboundNetworkConnections/:

Key Metadata Fields#

The XML representation of InboundNetworkConnection defines the private cloud linkage:

Declarative XML and Package Manifest Examples#

Below is a declarative XML definition of an AWS PrivateLink inbound network connection:

<?xml version="1.0" encoding="UTF-8"?>
<InboundNetworkConnection xmlns="http://soap.sforce.com/2006/04/metadata">
    <masterLabel>AWS Production PrivateLink</masterLabel>
    <connectionType>AwsPrivateLink</connectionType>
    <serviceRegion>us-east-1</serviceRegion>
    <status>Ready</status>
</InboundNetworkConnection>

Package Manifest (package.xml)#

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>AWS_Production_PrivateLink</members>
        <name>InboundNetworkConnection</name>
    </types>
    <version>68.0</version>
</Package>

Retrieval and Deployment via SF CLI#

Retrieve and deploy inbound network connections:

# Retrieve inbound network connection definition
sf project retrieve start --metadata "InboundNetworkConnection:AWS_Production_PrivateLink"

# Deploy network connection metadata
sf project deploy start --metadata "InboundNetworkConnection" --target-org prod-org

Senior Architect Best Practices and Gotchas#

• Cross-Cloud Handshake: Deploying the metadata initiates the Salesforce side of the connection. The external cloud provider (AWS/Azure) must accept the connection request before status flips to Ready.
• Region Constraints: Ensure the serviceRegion matches the specific AWS/Azure region where the enterprise VPC endpoint service is provisioned.
• Sandbox Testing: Dedicated Private Connect licenses must be provisioned in sandboxes to validate private routing before production deployment.

Frequently asked questions

What is InboundNetworkConnection used for?

It configures Salesforce Private Connect endpoints allowing external cloud resources to connect to Salesforce privately.

Which cloud infrastructure providers are supported?

Amazon Web Services (AWS PrivateLink) and Microsoft Azure (Private Link) are supported.

Where are InboundNetworkConnection files stored?

They are located in force-app/main/default/inboundNetworkConnections/ with the .inboundNetworkConnection-meta.xml suffix.

What security advantage does Private Connect provide?

Traffic remains within private cloud backbones, completely avoiding traversal over the public internet.