When you create an AWS data source or configure a migration task in OceanBase Cloud, you can use a peering connection to access the VPC where the data source resides. This topic describes how to create an AWS data service peering connection and how to use an existing connection to configure a data source.
Background
A VPC peering connection enables private communication between two VPCs. OceanBase Cloud supports the following types of peering connections:
- Instance peering connection: Connects the VPC of your application to the VPC of an OceanBase Cloud instance so that the application can access the database.
- Data service peering connection: Connects the OceanBase Cloud data service VPC to the VPC of a data source so that data migration, synchronization, and validation tasks can access the data source.
This topic describes how to configure and use an AWS data service peering connection.
Prerequisites
You have registered an OceanBase Cloud account and have the Organization Admin, Project Admin, or Data Services Admin role required to manage data service peering connections.
You use an AWS account that has the permissions required to accept peering connection requests, configure route tables, and adjust security groups or other network rules.
You have obtained the AWS account ID, VPC ID, and IPv4 CIDR block of the VPC where the data source resides. To find this information:
- In the Amazon VPC console, open Your VPCs to view the VPC ID and IPv4 CIDR block.
- View the account ID in the AWS console. Use the ID of the AWS account that owns the VPC. For instructions, see View your AWS account ID.
Considerations
- The Local Region selected in OceanBase Cloud must be the same as the AWS region of the peer VPC.
- The CIDR blocks of the two VPCs cannot be identical or overlap. If either VPC has multiple CIDR blocks, none of the CIDR blocks can overlap. For more information, see VPC peering limitations.
- In the same cloud vendor and region, you cannot create multiple data service peering connections for the same peer VPC. Use an existing connection if one is available.
- By default, you can create up to five data service peering connections for the same AWS account ID in the same region. If the limit is reached, delete connections that are no longer used before you create another one.
Create a peering connection for the first time
If no data service peering connection is available, create one in OceanBase Cloud, accept the request and configure the route in AWS, and then use the connection to configure a data source.
Step 1: Configure the peering connection
Log in to the OceanBase Cloud console. In the left-side navigation pane, click Networking.
On the Peering connection (Data services) page, click Create.
In the Create data service peering connection dialog box, under Step 1: Configure the peering connection, configure Cloud provider and Local region.
ParameterDescriptionCloud provider Select AWS. Local region Select the AWS region where the peer VPC resides. In the VPC of the peer data source instance section, click Virtual Private Cloud to go to the Amazon VPC console. Obtain the VPC information and configure the following parameters.
ParameterDescriptionPeer account ID Enter the ID of the AWS account that owns the VPC where the data source resides. You can view it in the AWS console. For instructions, see View your AWS account ID. Peer VPC ID Enter the ID of the VPC where the data source resides. You can view it on the Your VPCs page in the Amazon VPC console. Peer CIDR View the IPv4 CIDR block of the VPC where the data source resides on the Your VPCs page in the Amazon VPC console. Note
- Enter the IPv4 CIDR blocks to access in the peer VPC. Make sure that they include the private IP address of the data source.
- To add multiple CIDR blocks, press Enter after each CIDR block.
Click Create. After you submit the creation request, record the peering connection ID, local VPC ID, and local CIDR block for accepting the connection and configuring the route.
Step 2: Accept the connection
Under Step 2: Accept the connection, view the connection status and local information. If the status is Waiting for connection, accept the request in AWS.
ParameterDescriptionPeering connection ID The ID used to locate the peering connection request in AWS. Local account ID The AWS account ID of the OceanBase Cloud data service VPC. Local VPC ID The ID of the OceanBase Cloud data service VPC. Local CIDR The CIDR block of the OceanBase Cloud data service VPC. Use it when you configure the route. Click Peering connections to go to the VPC peering connections page in AWS, and accept the request from the local VPC.
Complete the operation before the AWS acceptance period expires. Otherwise, the peering connection request becomes invalid. For more information, click Learn more in OceanBase Cloud.
Return to the OceanBase Cloud console. Under Step 2: Accept the connection, click Checking connection status. After OceanBase Cloud confirms that the request is accepted, configure the route.
Step 3: Add a routing policy
Under Step 3: Add a route policy, click VPC to go to the Amazon VPC console.
Locate the peer VPC by using the Peer VPC ID, open its details page, and select the route table associated with the subnet where the data source resides.
Choose Edit routes > Add route. For Destination, enter the Local CIDR displayed in OceanBase Cloud. For Target, select the Peering connection ID displayed in OceanBase Cloud, and save the changes.
Return to the OceanBase Cloud console. Under Step 3: Add a route policy, click Done. The connection status changes to Connected after the configuration takes effect.
Use an existing peering connection
If a data service peering connection is in the Connected state, you can select it when you create a data source.
Log in to the OceanBase Cloud console. In the left-side navigation pane, choose Data Services > Data Source.
Click Create Data Source, and select the data source type.
Set Cloud provider to AWS, select the region and an instance type that supports peering connections, and set Connection type to Peering connection.
Select the target connection from the Peering connection ID drop-down list. Verify that its peer VPC ID and peer CIDR block match the network of the data source.
The list displays only connections in the Connected state for the selected cloud vendor and region. If no connection is available, complete the steps in Create a peering connection for the first time.
Enter the private connection address, port, and authentication information required for the data source type. The connection address can be an IP address or domain name. If you use a domain name, make sure that it can be resolved to a reachable private IP address in the data service network. For a Kafka data source, enter the Kafka endpoint.
Click Test Connection. After the connection test succeeds, click Save.
For information about other data source parameters, see Create a data source. You can reference the data source in a migration task or select the peering connection when you directly configure a data source in the task. For task-specific instructions, see the relevant topic under Migrate data.
Note
A Connected peering connection does not indicate that the database connection test will succeed. If the test fails, check whether the route table is associated with the subnet of the data source and whether the security group, network ACL, DNS resolution, database listening port, and account permissions are correctly configured.
Follow-up operations
Continue the configuration
If the connection configuration is incomplete, on the Networking > Peering connection (Data services) page, find the connection in the Pending acceptance or Route configuration pending state, and click Continue to complete the remaining steps.
Delete a peering connection
On the Peering connection (Data services) page, check Associated resources for the target connection. If the connection has associated resources, release the resources after you confirm that they are no longer required.
In the Actions column of the target connection, click the Delete icon and confirm the operation.
In AWS, delete the routes and other user-side configurations that are no longer required for the peering connection.
Warning
- Deleting a peering connection interrupts network access through the connection and cannot be undone. OceanBase Cloud removes only the configuration that it manages. You must remove the remaining user-side configuration.
- You cannot modify the peering connection of an existing data source. To use another peering connection, create a data source and select it when you configure subsequent tasks.