# Service endpoints for Amazon Keyspaces
**Topics**
+ [Ports and protocols](#ports)
+ [Global endpoints](#global_endpoints)
+ [AWS GovCloud (US) Region FIPS endpoints](#fips_endpoints)
+ [China Regions endpoints](#china_endpoints)
+ [Streams endpoints](#streams_endpoints)
+ [Connecting to dual-stack endpoints](dualstack_endpoints.md)
## Ports and protocols
You can access Amazon Keyspaces programmatically by running a `cqlsh` client, with an Apache 2.0 licensed Cassandra driver, or by using the AWS CLI and the AWS SDK.
The following table shows the ports and protocols for the different access mechanisms.
| Programmatic Access | Port | Protocol |
| --- | --- | --- |
| CQLSH | 9142 | TLS |
| Cassandra Driver | 9142 | TLS |
| AWS CLI | 443 | HTTPS |
| AWS SDK | 443 | HTTPS |
For TLS connections, Amazon Keyspaces uses certificates issued under Amazon Trust Services (Amazon Root CAs 1–4) to authenticate against the server. For more information, see [How to manually configure `cqlsh` connections for TLS](programmatic.cqlsh.md#encrypt_using_tls) or the [Before you begin](using_java_driver.md#using_java_driver.BeforeYouBegin) section of your driver in the [Using a Cassandra client driver to access Amazon Keyspaces programmatically](programmatic.drivers.md) chapter.
## Global endpoints
Amazon Keyspaces supports both IPv4 and IPv6 public endpoints. You can choose between IPv4 endpoints and dual-stack endpoints. The endpoints use the following naming convention, where you can replace *us-east-1* with another available AWS Region from the table.
+ **IPv4 endpoints** – `cassandra.us-east-1.amazonaws.com`
+ **Dual-stack endpoints** – `cassandra.us-east-1.api.aws`
For more information about dual-stack endpoints and how to configure connections, see [Connecting to dual-stack endpoints](dualstack_endpoints.md).
Amazon Keyspaces is available in the following Regions.
[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/programmatic.endpoints.html)
## AWS GovCloud (US) Region FIPS endpoints
Available FIPS endpoints in the AWS GovCloud (US) Region. Amazon Keyspaces supports both IPv4 and IPv6 FIPS endpoints. You can choose between IPv4 endpoints and dual-stack endpoints. For more information, see [Amazon Keyspaces in the *AWS GovCloud (US) User Guide*](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-keyspaces.html).
[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/programmatic.endpoints.html)
## China Regions endpoints
Amazon Keyspaces supports IPv4 endpoints in the AWS China Regions.
To access these endpoints, you have to sign up for a separate set of account credentials unique to the China Regions. For more information, see [China Signup, Accounts, and Credentials](https://docs.amazonaws.cn/en_us/aws/latest/userguide/accounts-and-credentials.html).
[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/programmatic.endpoints.html)
## Streams endpoints
Amazon Keyspaces CDC streams is available in the following AWS Regions. This table shows the available dual-stack service endpoint for each Region. For more information about Amazon Keyspaces CDC streams, see [How to access CDC stream endpoints in Amazon Keyspaces](CDC_access-endpoints.md).
[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/keyspaces/latest/devguide/programmatic.endpoints.html)
# Connecting to dual-stack endpoints
Amazon Keyspaces global endpoints are dual-stack endpoints that accept IPv4 and IPv6 requests.
When connecting to Amazon Keyspaces using IPv6, the service automatically adapts system table responses to match your connection protocol. This ensures that your applications receive consistent network address information matching their connection type. This provides accurate network topology information to the client while maintaining backward compatibility for existing CQL applications.
Amazon Keyspaces detects the network protocol (IPv4 or IPv6) used by your client connection automatically and adjusts the system table responses accordingly. This detection happens transparently during the initial connection handshake, requiring no additional configuration from the client application.
Amazon Keyspaces returns IP addresses based on your connection protocol. For example, a request from an IPv4 network returns the following response.
```
SELECT * FROM system.peers;
-- Returns IPv4 addresses in peer column
-- Example: 172.31.1.1, 172.31.1.2, etc.
```
A connection from an IPv6 network to a dual-stack endpoint, for example `cassandra.us-east-1.api.aws`, returns the following response.
```
SELECT * FROM system.peers;
-- Returns IPv6 addresses in peer column
-- Example: 2001:db8::1, 2001:db8::2, etc.
```
For more information about IPv6 support in Amazon Keyspaces, see [IPv6 support in Amazon Keyspaces](ipv6-support.md).