Plan your networking configuration

This page provides a high-level overview of what you need to consider when you plan network connectivity for your migration.

From a networking perspective, Database Migration Service and AlloyDB for PostgreSQL are service producers that reside in their own dedicated networks (known as service networks), outside the Virtual Private Cloud (VPC) networks that you use in your Google Cloud project.

Depending on whether you perform a standard migration or a quick-start migration, Database Migration Service leverages different networking architectures to connect to your databases. This page focuses primarily on networking considerations for standard continuous migrations.

Standard migration connectivity

For standard homogeneous PostgreSQL migrations to AlloyDB for PostgreSQL, Database Migration Service connects to the destination AlloyDB for PostgreSQL cluster and manages the migration process on its behalf. It's the destination cluster that establishes the direct network connection to your source instance, while Database Migration Service oversees the process.

The goal of configuring network connectivity for a standard migration is to ensure that the destination AlloyDB for PostgreSQL cluster can route to and reach your source database server over the network.

Different connectivity methods are available depending on your source database offering and your destination AlloyDB for PostgreSQL network configuration:

  • IP allowlist: Connects over the public internet by adding the destination outbound IP address to the source firewall or allowlist.
  • Reverse SSH tunnel: Routes replication traffic through an intermediate Compute Engine bastion host over an encrypted SSH tunnel.
  • TCP proxy through a cloud-hosted VM: Routes replication traffic through a containerized TCP proxy on an intermediate Compute Engine VM when direct routing between networks isn't possible.
  • Private connectivity with VPC peering: Connects to the private IP address of your source database across peered VPC networks (for Private Services Access destination clusters).
  • Private connectivity with Private Service Connect interfaces: Connects to the private IP address of your source database using network attachments (for PSC-enabled destination clusters).

Before you configure your source instance for migration, see the Networking overview page to evaluate the end-to-end networking landscape and pick the best method for your scenario.

Quick-start migrations connectivity

Quick-start migrations use a mediated networking model where Database Migration Service acts as an intermediary sitting between your source database and the destination AlloyDB for PostgreSQL cluster:

  • Source connectivity: Database Migration Service connects to your source database using Private Service Connect interfaces and private connectivity configurations. Your source database must have a private IP address assigned within a Google Cloud VPC network. If your source database is hosted outside Google Cloud, you must connect it to your VPC network using Cloud VPN or Cloud Interconnect. Other methods (such as public IP allowlists or reverse SSH tunnels) aren't supported.

  • Destination connectivity: Database Migration Service fully manages network communication to your destination instance. The destination cluster must be enabled for Private Service Connect.

For a comprehensive explanation of the quick-start networking architecture, component diagrams, and limitations, see Network connectivity for quick-start migrations in the main Database Migration Service documentation.

What's next