Network connectivity methods

Before you create a stream in Datastream, you must establish network connectivity between Datastream and your source database. Depending on your security requirements and network topology, you can connect using public IP allowlists, an encrypted forward SSH tunnel, or private connectivity.

Use the following table to compare the network connectivity methods and choose the option that best fits your workload:

Network connectivity method Description Things to consider
IP allowlist

Works by configuring the source database server to allow incoming connections from Datastream's external IP addresses. To find out the IP addresses for your regions, see IP allowlists and regions.
  • The source database is exposed to a public IP address.
  • The connection isn't encrypted by default. SSL must be enabled on the source database to encrypt the connection.
  • Configuring the firewall may require assistance from the IT department.
Forward SSH tunnel

Establish an encrypted connection over public networks between Datastream and the source, through a forward-SSH tunnel.
  • Limited bandwidth
  • You must set up and maintain the bastion host.
Private Service Connect interfaces Works by creating a private connectivity configuration. Datastream uses this configuration to communicate with the data source over a private network. This communication happens through a network attachment set up in the customer VPC network.
  • Requires setting up a network attachment and adjusting firewall rules.
  • You can't migrate existing private connectivity configurations to Private Service Connect interfaces.
  • You can't change the network attachment after you create your Private Service Connect interface connection.
  • Allowlisting incoming connections from the Datastream IP addresses is available only on a project ID basis.
VPC peering Works by creating a private connectivity configuration. Datastream uses this configuration to communicate with the data source over a private network. This communication happens through a Virtual Private Cloud (VPC) peering connection.
  • Requires a private network connection (VPN, Interconnect, etc.) between the database and Google Cloud.

What's next