Configure network connectivity for Amazon Aurora and Amazon RDS sources

This page describes how to configure network connectivity for Amazon Aurora and Amazon RDS sources for homogeneous PostgreSQL migrations to AlloyDB for PostgreSQL clusters with Database Migration Service. There are several methods you can use:

You can also use a reverse-SSH tunnel, but this approach requires creating an intermediate Compute Engine Virtual Machine (VM) to host the necessary network components.

Configure Private Service Connect interfaces

This connectivity method lets you connect to the private IP of your source database without consuming VPC peering quota. Private Service Connect interfaces are the recommended method for private IP connectivity when migrating to an AlloyDB for PostgreSQL cluster. Private Service Connect interfaces are supported when you migrate to an existing AlloyDB for PostgreSQL cluster.

To use private connectivity with Private Service Connect interfaces for Amazon RDS or Amazon Aurora sources, follow these steps:

  1. Set up direct connectivity with Cloud VPN from Google Cloud to your source VPC in AWS.

    Depending on your network architecture, you might need to set up additional VPN gateways in your system. For more information, see Create HA VPN connections between Google Cloud and AWS in the Cloud VPN documentation.

  2. Create or select a destination AlloyDB for PostgreSQL cluster enabled for Private Service Connect. See Create a cluster and primary instance in the AlloyDB for PostgreSQL documentation.
  3. Configure Private Service Connect for outbound connectivity from your destination cluster. At a high level, this process involves:
    1. Creating a network attachment in the Virtual Private Cloud network where you set up your Cloud VPN. The subnet range reserved for the network attachment must be within RFC 1918 range.
    2. Assigning the network attachment to your destination AlloyDB for PostgreSQL cluster.

    For more information, see Configure Private Service Connect in the AlloyDB for PostgreSQL documentation.

  4. At a later stage, when you create the source connection profile, use the private IP address or private DNS endpoint of your source database instance in AWS.
  5. When you create the migration job, select PSC interface for your connectivity method.

Configure VPC peering

To use private connectivity with Virtual Private Cloud peering for Amazon RDS or Amazon Aurora sources, follow these steps:

  1. Set up direct connectivity with Cloud VPN from Google Cloud to your source VPC in AWS.

    Depending on your network architecture, you might need to set up additional VPN gateways in your system. For more information, see Create HA VPN connections between Google Cloud and AWS in the Cloud VPN documentation.

    Ensure the Virtual Private Cloud network is configured for private services access. For more information, see Configure private services access.

  2. Make sure your destination AlloyDB for PostgreSQL cluster is configured with a private IP and Private Services Access (PSA) using the same Virtual Private Cloud network. For more information, see Create a cluster and primary instance in the AlloyDB for PostgreSQL documentation.
  3. At a later stage, when you create the source connection profile, use the private IP address of your source database instance.
  4. When you create the migration job, select VPC Peering for your connectivity method.

Configure IP allowlist connectivity

To use the public IP allowlist connectivity method, follow these steps:

  1. In the AWS Management Console, perform the following steps:
    1. Ensure that your source Amazon RDS or Amazon Aurora database is configured for public IP connections.
    2. Identify the database endpoint name and port number. You need to enter these values when you create the connection profile.

      PostgreSQL servers by default use port 5432.

  2. Ensure that outbound public IP is enabled on your destination AlloyDB for PostgreSQL primary instance, and check both of its outbound public IP addresses. For more information, see Enable outbound public IP and View cluster and instance details.

  3. In your AWS VPC, create or update a security group that allows inbound traffic on port 5432 from both outbound public IP addresses of your destination AlloyDB for PostgreSQL primary instance. See Provide access to your DB instance in your VPC by creating a security group in the AWS documentation.

  4. At a later stage, when you create the source connection profile, use the endpoint name for the source database IP or hostname.
  5. When you create the migration job, select IP allowlist for your connectivity method.

What's next