Networking and security - Hilt Documentation

Outbound

Only one destination: DAG_SHIP_URL (the Hilt ingest PrivateLink endpoint in your account). Traffic is HTTPS with your CA chain; the endpoint presents an ACM certificate issued against your private zone.
No DNS leakage to public resolvers is required. The ingest domain is in a private Route 53 zone associated with your VPC, so resolution happens inside your VPC and the TCP path rides the PrivateLink endpoint service to the ingest NLB.
Firewall rule: allow the agent’s source CIDR to reach the PrivateLink endpoint on TCP/443. For cross-VPC rollouts the PrivateLink consumer endpoint is the gateway; for same-VPC rollouts traffic is purely intra-VPC.

The release includes a static binary and a docker save-able image; nothing at runtime fetches updates.
In file mode (DAG_SHIP_URL unset), the agent writes JSONL locally and your existing log shipper takes it from there.

Path	Requires
VM / systemd	Must run as root; systemd unit uses default privileges + `LimitMEMLOCK=infinity`
Kubernetes DaemonSet	`securityContext.privileged: true` + `hostPID` + `hostNetwork`
Docker standalone	`--privileged` + `--pid=host`

Events never leave your AWS account. Hilt does not receive, mirror, or have out-of-band access to agent events.