Skip to content

Commit

Permalink
docs: re-organize info on SSH and ip whitelisting
Browse files Browse the repository at this point in the history
  • Loading branch information
@oliviamiannone
oliviamiannone committed Oct 24, 2023
1 parent 06bc728 commit 59cbdc2
Show file tree
Hide file tree
Showing 12 changed files with 163 additions and 232 deletions.
76 changes: 26 additions & 50 deletions site/docs/reference/Connectors/capture-connectors/MySQL.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -82,22 +82,15 @@ Estuary recommends creating a [read replica](https://aws.amazon.com/rds/features
in RDS for use with Flow; however, it's not required.
You're able to apply the connector directly to the primary instance if you'd like.

1. Allow connections to the database from the Estuary Flow IP address.
1. Allow connections between the database and Estuary Flow. There are two ways to do this: by granting direct access to Flow's IP or by creating an SSH tunnel.

1. [Modify the database](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html), setting **Public accessibility** to **Yes**. See the directions below to use a SSH Tunnel instead of enabling public access.
1. To allow direct access:
* [Modify the database](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html), setting **Public accessibility** to **Yes**.
* Edit the VPC security group associated with your database, or create a new VPC security group and associate it with the database as described in [the Amazon documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.RDSSecurityGroups.html#Overview.RDSSecurityGroups.Create). Create a new inbound rule and a new outbound rule that allow all traffic from the IP address `34.121.207.128`.

1. Edit the VPC security group associated with your database, or create a new VPC security group and associate it with the database.
Refer to the [steps in the Amazon documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.RDSSecurityGroups.html#Overview.RDSSecurityGroups.Create).
Create a new inbound rule and a new outbound rule that allow all traffic from the IP address `34.121.207.128`.

:::info
Alternatively, you can allow secure connections via SSH tunneling. To do so:
* Follow the guide to [configure an SSH server for tunneling](../../../../guides/connect-network/)
* When you configure your connector as described in the [configuration](#configuration) section above,
including the additional `networkTunnel` configuration to enable the SSH tunnel.
See [Connecting to endpoints on secure networks](../../../concepts/connectors.md#connecting-to-endpoints-on-secure-networks)
for additional details and a sample.
:::
2. To allow secure connections via SSH tunneling:
* Follow the guide to [configure an SSH server for tunneling](../../../../guides/connect-network/)
* When you configure your connector as described in the [configuration](#configuration) section above, including the additional `networkTunnel` configuration to enable the SSH tunnel. See [Connecting to endpoints on secure networks](../../../concepts/connectors.md#connecting-to-endpoints-on-secure-networks) for additional details and a sample.

2. Create a RDS parameter group to enable replication in MySQL.

Expand Down Expand Up @@ -155,22 +148,15 @@ You must apply some of the settings to the entire Aurora DB cluster, and others
(we recommend you use a [replica, or reader instance](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Overview.html) to connect with Flow).
For each step, take note of which entity you're working with.

1. Allow connections to the database from the Estuary Flow IP address.

1. [Modify the instance](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Modifying.html#Aurora.Modifying.Instance), choosing **Publicly accessible** in the **Connectivity** settings. See the directions below to use a SSH Tunnel instead of enabling public access.
1. Allow connections between the database and Estuary Flow. There are two ways to do this: by granting direct access to Flow's IP or by creating an SSH tunnel.

2. Edit the VPC security group associated with your instance, or create a new VPC security group and associate it with the instance.
Refer to the [steps in the Amazon documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.RDSSecurityGroups.html#Overview.RDSSecurityGroups.Create).
Create a new inbound rule and a new outbound rule that allow all traffic from the IP address `34.121.207.128`.
1. To allow direct access:
* [Modify the instance](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Modifying.html#Aurora.Modifying.Instance), choosing **Publicly accessible** in the **Connectivity** settings.
* Edit the VPC security group associated with your instance, or create a new VPC security group and associate it with the instance as described in [the Amazon documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.RDSSecurityGroups.html#Overview.RDSSecurityGroups.Create). Create a new inbound rule and a new outbound rule that allow all traffic from the IP address `34.121.207.128`.

:::info
Alternatively, you can allow secure connections via SSH tunneling. To do so:
* Follow the guide to [configure an SSH server for tunneling](../../../../guides/connect-network/)
* When you configure your connector as described in the [configuration](#configuration) section above,
including the additional `networkTunnel` configuration to enable the SSH tunnel.
See [Connecting to endpoints on secure networks](../../../concepts/connectors.md#connecting-to-endpoints-on-secure-networks)
for additional details and a sample.
:::
2. To allow secure connections via SSH tunneling:
* Follow the guide to [configure an SSH server for tunneling](../../../../guides/connect-network/)
* When you configure your connector as described in the [configuration](#configuration) section above, including the additional `networkTunnel` configuration to enable the SSH tunnel. See [Connecting to endpoints on secure networks](../../../concepts/connectors.md#connecting-to-endpoints-on-secure-networks) for additional details and a sample.

2. Create a RDS parameter group to enable replication on your Aurora DB cluster.

Expand Down Expand Up @@ -213,19 +199,14 @@ CALL mysql.rds_set_configuration('binlog retention hours', 168);

### Google Cloud SQL

1. Allow connections to the DB instance from the Estuary Flow IP address.
1. Allow connections between the database and Estuary Flow. There are two ways to do this: by granting direct access to Flow's IP or by creating an SSH tunnel.

1. [Enable public IP on your database](https://cloud.google.com/sql/docs/mysql/configure-ip#add) and add
`34.121.207.128` as an authorized IP address. See the directions below to use a SSH Tunnel instead of enabling public access.
1. To allow direct access:
* [Enable public IP on your database](https://cloud.google.com/sql/docs/mysql/configure-ip#add) and add `34.121.207.128` as an authorized IP address.

:::info
Alternatively, you can allow secure connections via SSH tunneling. To do so:
* Follow the guide to [configure an SSH server for tunneling](../../../../guides/connect-network/)
* When you configure your connector as described in the [configuration](#configuration) section above,
including the additional `networkTunnel` configuration to enable the SSH tunnel.
See [Connecting to endpoints on secure networks](../../../concepts/connectors.md#connecting-to-endpoints-on-secure-networks)
for additional details and a sample.
:::
2. To allow secure connections via SSH tunneling:
* Follow the guide to [configure an SSH server for tunneling](../../../../guides/connect-network/)
* When you configure your connector as described in the [configuration](#configuration) section above, including the additional `networkTunnel` configuration to enable the SSH tunnel. See [Connecting to endpoints on secure networks](../../../concepts/connectors.md#connecting-to-endpoints-on-secure-networks) for additional details and a sample.

2. Set the instance's `binlog_expire_logs_seconds` [flag](https://cloud.google.com/sql/docs/mysql/flags?_ga=2.8077298.-1359189752.1655241239&_gac=1.226418280.1655849730.Cj0KCQjw2MWVBhCQARIsAIjbwoOczKklaVaykkUiCMZ4n3_jVtsInpmlugWN92zx6rL5i7zTxm3AALIaAv6nEALw_wcB)
to `2592000`.
Expand Down Expand Up @@ -253,19 +234,14 @@ Together, you'll use the host:port as the `address` property when you configure

### Azure Database for MySQL

1. Allow connections to the database from the Estuary Flow IP address.
1. Allow connections between the database and Estuary Flow. There are two ways to do this: by granting direct access to Flow's IP or by creating an SSH tunnel.

1. Create a new [firewall rule](https://docs.microsoft.com/en-us/azure/mysql/flexible-server/how-to-manage-firewall-portal#create-a-firewall-rule-after-server-is-created)
that grants access to the IP address `34.121.207.128`.
1. To allow direct access:
* Create a new [firewall rule](https://docs.microsoft.com/en-us/azure/mysql/flexible-server/how-to-manage-firewall-portal#create-a-firewall-rule-after-server-is-created) that grants access to the IP address `34.121.207.128`.

:::info
Alternatively, you can allow secure connections via SSH tunneling. To do so:
* Follow the guide to [configure an SSH server for tunneling](../../../../guides/connect-network/)
* When you configure your connector as described in the [configuration](#configuration) section above,
including the additional `networkTunnel` configuration to enable the SSH tunnel.
See [Connecting to endpoints on secure networks](../../../concepts/connectors.md#connecting-to-endpoints-on-secure-networks)
for additional details and a sample.
:::
2. To allow secure connections via SSH tunneling:
* Follow the guide to [configure an SSH server for tunneling](../../../../guides/connect-network/)
* When you configure your connector as described in the [configuration](#configuration) section above, including the additional `networkTunnel` configuration to enable the SSH tunnel. See [Connecting to endpoints on secure networks](../../../concepts/connectors.md#connecting-to-endpoints-on-secure-networks) for additional details and a sample.

2. Set the `binlog_expire_logs_seconds` [server perameter](https://docs.microsoft.com/en-us/azure/mysql/single-server/concepts-server-parameters#configurable-server-parameters)
to `2592000`.
Expand Down
Loading

0 comments on commit 59cbdc2

Please sign in to comment.