Plan your networking configuration

This page provides a high-level overview of what you need to consider when you plan network connectivity for your migration.

From a networking point of view, Database Migration Service and Cloud SQL are service producers that reside in their own dedicated networks (known as service networks), outside the Virtual Private Cloud (VPC) networks that you use in your Google Cloud project.

Depending on whether you choose a standard migration or a quick-start migration, Database Migration Service uses different networking architectures to connect to your databases. This page focuses primarily on networking considerations for standard migrations.

Standard migration connectivity

For standard homogeneous PostgreSQL migrations to Cloud SQL, Database Migration Service connects to the destination Cloud SQL for PostgreSQL instance and manages the migration process on its behalf. It's the destination instance that establishes the direct network connection to your source instance, while Database Migration Service oversees the process.

The goal of configuring network connectivity for a standard migration is to ensure that the destination Cloud SQL for PostgreSQL instance can route to and reach your source database server over the network.

Different connectivity methods are available depending on your source database offering and your destination Cloud SQL for PostgreSQL network configuration:

  • IP allowlist: Connects over the public internet by adding the destination outbound IP address to the source firewall or allowlist.
  • Reverse SSH tunnel: Routes replication traffic through an intermediate Compute Engine bastion host over an encrypted SSH tunnel.
  • Private connectivity with VPC peering: Connects to the private IP address of your source database across peered VPC networks (for Private Services Access destination instances).
  • Private connectivity with Private Service Connect interfaces: Connects to the private IP address of your source database using network attachments (for PSC-enabled destination instances).

Before you configure your source instance for migration, see the Networking overview page to evaluate the end-to-end networking landscape and pick the best method for your scenario.

Quick-start migrations connectivity

Quick-start migrations use a mediated networking model where Database Migration Service acts as an intermediary sitting between your source database and the destination Cloud SQL for PostgreSQL instance:

  • Source connectivity: Database Migration Service connects to your source database using Private Service Connect interfaces and private connectivity configurations. Your source database must have a private IP address assigned within a Google Cloud VPC network. If your source database is hosted outside Google Cloud, you must connect it to your VPC network using a Cloud VPN or Cloud Interconnect connection. Other methods (such as public IP allowlists or reverse SSH tunnels) aren't supported.
  • Destination connectivity: Database Migration Service fully manages network communication to your destination instance. The destination instance must be enabled for Private Service Connect.

For a comprehensive explanation of the quick-start networking architecture, component diagrams, and limitations, see Network connectivity for quick-start migrations in the main Database Migration Service documentation.

What's next