Skip to content

Commit d29010f

Browse files
bsod90igorlukanin
authored and
marianore-muttdata
committed
docs: Added AWS PrivateLink doc (cube-js#9571)
* docs: Added AWS PrivateLink doc * Fix --------- Co-authored-by: Igor Lukanin <[email protected]>
1 parent 54d7754 commit d29010f

File tree

4 files changed

+203
-133
lines changed

4 files changed

+203
-133
lines changed

‎docs/pages/product/deployment/cloud/vpc/aws.mdx‎

Lines changed: 10 additions & 133 deletions
Original file line numberDiff line numberDiff line change
@@ -5,139 +5,16 @@ redirect_from:
55

66
# Connecting with a VPC on AWS
77

8-
To connect with a VPC on AWS, you need to collect the necessary information and
9-
hand it over to your Cube Cloud representative. Next, you'll have to accept a
10-
VPC peering request sent by Cube Cloud. Finally, you'll need to configure
11-
security groups and route tables to ensure Cube Cloud can connect to your data
12-
source.
8+
[Dedicated infrastructure][dedicated-infrastructure] in Cube Cloud comes with
9+
an option of setting up a direct network connection between
10+
an AWS VPC on the Cube Cloud side and your own VPC(s). Such a connection allows you to
11+
access internal datasources without the need to expose any ports publicly.
1312

14-
## Prerequisites
13+
On AWS, Cube Cloud supports two main ways of establishing a private network connection:
1514

16-
To allow Cube Cloud to connect to a [VPC on AWS][aws-docs-vpc], the following
17-
information is required:
15+
- [AWS PrivateLink][aws-private-link]
16+
- [VPC Peering][aws-vpc-peering]
1817

19-
- **AWS Account ID:** The AWS account ID of the VPC owner. This can be found in
20-
the top-right corner of [the AWS Console][aws-console].
21-
- **AWS Region:** [The AWS region][aws-docs-regions] that the VPC resides in.
22-
- **AWS VPC ID:** The ID of the VPC that Cube Cloud will connect to, for
23-
example, `vpc-0099aazz`
24-
- **AWS VPC CIDR:** The [CIDR block][wiki-cidr-block] of the VPC that Cube Cloud
25-
will connect to, for example, `10.0.0.0/16`
26-
27-
## Setup
28-
29-
### VPC Peering Request
30-
31-
After receiving the information above, Cube Cloud will send a [VPC peering
32-
request][aws-docs-vpc-peering] that must be accepted. This can be done either
33-
through the [AWS Web Console][aws-console] or through an infrastructure-as-code
34-
tool.
35-
36-
To [accept the VPC peering request][aws-docs-vpc-peering-accept] through the AWS
37-
Web Console, follow the instructions below:
38-
39-
1. Open the [Amazon VPC console](https://console.aws.amazon.com/vpc/).
40-
41-
<WarningBox>
42-
43-
Ensure you have the necessary permissions to accept a VPC peering request. If
44-
you are unsure, please contact your AWS administrator.
45-
46-
</WarningBox>
47-
48-
2. Use the Region selector to choose the Region of the accepter VPC.
49-
50-
3. In the navigation pane, choose <Btn>Peering connections</Btn>.
51-
52-
4. Select the pending VPC peering connection (the status should be
53-
`pending-acceptance`), then choose <Btn>Actions</Btn>, followed by 
54-
​<Btn>Accept request</Btn>.
55-
56-
<WarningBox>
57-
58-
Ensure the peering request is from Cube Cloud by checking that the **AWS account
59-
ID**, **region** and **VPC IDs** match those provided by your CSM.
60-
61-
</WarningBox>
62-
63-
5. When prompted for confirmation, choose <Btn>Accept request</Btn>.
64-
65-
6. Choose <Btn>Modify my route tables now</Btn> to add a route to the VPC route
66-
table so that you can send and receive traffic across the peering
67-
connection.
68-
69-
<InfoBox>
70-
71-
For more information about peering connection lifecycle statuses, check out the
72-
[VPC peering connection lifecycle on AWS][aws-docs-vpc-peering-lifecycle].
73-
74-
</InfoBox>
75-
76-
### Updating security groups
77-
78-
The initial VPC setup will not allow traffic from Cube Cloud; this is because
79-
[the security group][aws-docs-vpc-security-group] for the database will need to
80-
allow access from the Cube Cloud CIDR block.
81-
82-
This can be achieved by adding a new security group rule:
83-
84-
| Protocol | Port Range | Source/Destination |
85-
| -------- | ---------- | --------------------------------------------- |
86-
| TCP | 3306 | The Cube Cloud CIDR block for the AWS region. |
87-
88-
### Update route tables
89-
90-
The final step is to update route tables in your VPC to allow traffic from Cube
91-
Cloud to reach your database. The Cube Cloud CIDR block must be added to the
92-
route tables of all subnets that connect to the database. To do this, follow the
93-
instructions on [the AWS documentation][aws-docs-vpc-peering-routing].
94-
95-
## Troubleshooting
96-
97-
Database connection issues with misconfigured VPCs often manifest as connection
98-
timeouts. If you are experiencing connection issues, please check the following:
99-
100-
- Verify that
101-
[all security groups allow traffic](#setup-updating-security-groups) from the
102-
Cube Cloud provided CIDR block.
103-
- Verify that
104-
[a route exists to the Cube Cloud provided CIDR block](#setup-update-route-tables)
105-
from the subnets that connect to the database.
106-
107-
## Using dedicated pre-aggregation storage
108-
109-
On the Enterprise Premier product tier, you get an option to supply your own S3 bucket to
110-
be used as an underlying storage for Cube Store pre-aggregated data. This
111-
allows you to keep all data at-rest fully within your infrastructure while
112-
still leveraging the full power of the Cube Cloud for managed compute.
113-
114-
To activate this option, simply create an S3 bucket and generate a new AWS
115-
Access Key that would allow full bucket access for Cube Cloud. After it's done,
116-
request the dedicated pre-aggregation storage to be activated from your
117-
Customer Success Manager and share with them the following:
118-
119-
- **AWS Access Key Id**
120-
- **AWS Secret Access Key**
121-
- **S3 Bucket ARN**
122-
123-
[aws-console]: https://console.aws.amazon.com/
124-
[aws-docs-regions]:
125-
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#concepts-available-regions
126-
[aws-docs-vpc]:
127-
https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html
128-
[aws-docs-vpc-peering-accept]:
129-
https://docs.aws.amazon.com/vpc/latest/peering/create-vpc-peering-connection.html#different-account-different-region
130-
[aws-docs-vpc-peering-lifecycle]:
131-
https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html#vpc-peering-lifecycle
132-
[aws-docs-vpc-peering-routing]:
133-
https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-routing.html
134-
[aws-docs-vpc-peering]:
135-
https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html [aws-docs-vpc-security-group]: https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html
136-
[wiki-cidr-block]:
137-
https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_blocks
138-
139-
## Supported Regions
140-
141-
We support all general-purpose regions. Cube Store is currently located only in
142-
`US East 2` and `EU West 1` so pre-aggregations performance might depend on geographical
143-
proximity to it.
18+
[dedicated-infrastructure]: /product/deployment/cloud/infrastructure#dedicated-infrastructure
19+
[aws-private-link]: /product/deployment/cloud/vpc/aws/private-link
20+
[aws-vpc-peering]: /product/deployment/cloud/vpc/aws/vpc-peering

‎docs/pages/product/deployment/cloud/vpc/aws/_meta.js‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
module.exports = {
2+
"private-link": "PrivateLink",
3+
"vpc-peering": "VPC Peering",
4+
}

‎docs/pages/product/deployment/cloud/vpc/aws/private-link.mdx‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Connecting to your VPC using AWS PrivateLink
2+
3+
[AWS PrivateLink][aws-docs-private-link] provides private connectivity between virtual private clouds (VPCs), supported services and resources, and your on-premises networks, without exposing your traffic to the public internet.
4+
To set up a PrivateLink connection between Cube Cloud Dedicated Infrastructure and your own VPC,
5+
you'll need to prepare an Endpoint Service,
6+
share service details with the Cube team, and accept the incoming connection request.
7+
8+
## Preparing the Endpoint Service
9+
10+
There are two common scenarios for preparing the Endpoint Service:
11+
- Connecting to a service in your AWS infrastructure
12+
- Connecting to a service provided by a third party such as Snowflake, Databricks, Altinity Cloud, etc.
13+
14+
In the case of your own infrastructure, please follow the [official AWS documentation][aws-docs-endpoint-service] to configure the Endpoint Service
15+
pointing at your data source.
16+
17+
If your data source is hosted in a third-party infrastructure, please follow the vendor's documentation
18+
for creating and managing an Endpoint Service.
19+
20+
## Allowing Cube Cloud Principal
21+
22+
Cube Cloud needs to be added to the list of principals allowed to discover your Endpoint Service.
23+
To do so, please go to <Btn>AWS Console</Btn> -> <Btn>VPC</Btn> -> <Btn>Endpoint Services</Btn> -> <Btn>Your service</Btn> -> <Btn>Allow principals</Btn>
24+
and add `arn:aws:iam::331376342520` to the list.
25+
26+
## Gathering required information
27+
28+
To request establishing a PrivateLink connection, please share the following information with the Cube team:
29+
30+
- **Service Name** (such as `com.amazonaws.vpce.us-west-2.vpce-svc-abcde`)
31+
- **Reference Name** for the record (such as "Snowflake-prod" or "clickhouse-dev")
32+
- **Ports**: a list of ports that will be accessed through this connection
33+
- **DNS Name** (optional): an internal DNS name of the upstream service in case SSL needs to be supported
34+
35+
If a DNS name is provided, an internal DNS record will be created pointing at the established PrivateLink
36+
connection, and the service will be addressable by that name inside the Cube Cloud infrastructure.
37+
38+
## Accepting the connection
39+
40+
The Cube Cloud team will notify you once the connection request is sent. You can accept it by going to
41+
<Btn>AWS Console</Btn> -> <Btn>VPC</Btn> -> <Btn>Endpoint Services</Btn> -> <Btn>Your Service</Btn> -> <Btn>Endpoint Connections</Btn> and clicking
42+
<Btn>Accept Connection Request</Btn>.
43+
44+
## Using the connection
45+
46+
Once the connection is established, you can access your data source by addressing it either via the
47+
supplied DNS Name or an AWS internal DNS name returned to you by the Cube team.
48+
49+
[aws-docs-private-link]: https://aws.amazon.com/privatelink/
50+
[aws-docs-endpoint-service]: https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html

‎docs/pages/product/deployment/cloud/vpc/aws/vpc-peering.mdx‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
# Setting up a VPC Peering connection on AWS
2+
3+
To set up AWS VPC Peering, you need to collect the necessary information and
4+
hand it over to your Cube Cloud representative. Next, you'll have to accept a
5+
VPC peering request sent by Cube Cloud. Finally, you'll need to configure
6+
security groups and route tables to ensure Cube Cloud can connect to your data
7+
source.
8+
9+
## Prerequisites
10+
11+
To allow Cube Cloud to connect to a [VPC on AWS][aws-docs-vpc], the following
12+
information is required:
13+
14+
- **AWS Account ID:** The AWS account ID of the VPC owner. This can be found in
15+
the top-right corner of [the AWS Console][aws-console].
16+
- **AWS Region:** [The AWS region][aws-docs-regions] that the VPC resides in.
17+
- **AWS VPC ID:** The ID of the VPC that Cube Cloud will connect to, for
18+
example, `vpc-0099aazz`
19+
- **AWS VPC CIDR:** The [CIDR block][wiki-cidr-block] of the VPC that Cube Cloud
20+
will connect to, for example, `10.0.0.0/16`
21+
22+
## Setup
23+
24+
### VPC Peering Request
25+
26+
After receiving the information above, Cube Cloud will send a [VPC peering
27+
request][aws-docs-vpc-peering] that must be accepted. This can be done either
28+
through the [AWS Web Console][aws-console] or through an infrastructure-as-code
29+
tool.
30+
31+
To [accept the VPC peering request][aws-docs-vpc-peering-accept] through the AWS
32+
Web Console, follow the instructions below:
33+
34+
1. Open the [Amazon VPC console](https://console.aws.amazon.com/vpc/).
35+
36+
<WarningBox>
37+
38+
Ensure you have the necessary permissions to accept a VPC peering request. If
39+
you are unsure, please contact your AWS administrator.
40+
41+
</WarningBox>
42+
43+
2. Use the Region selector to choose the Region of the accepter VPC.
44+
45+
3. In the navigation pane, choose <Btn>Peering connections</Btn>.
46+
47+
4. Select the pending VPC peering connection (the status should be
48+
`pending-acceptance`), then choose <Btn>Actions</Btn>, followed by 
49+
​<Btn>Accept request</Btn>.
50+
51+
<WarningBox>
52+
53+
Ensure the peering request is from Cube Cloud by checking that the **AWS account
54+
ID**, **region** and **VPC IDs** match those provided by your CSM.
55+
56+
</WarningBox>
57+
58+
5. When prompted for confirmation, choose <Btn>Accept request</Btn>.
59+
60+
6. Choose <Btn>Modify my route tables now</Btn> to add a route to the VPC route
61+
table so that you can send and receive traffic across the peering
62+
connection.
63+
64+
<InfoBox>
65+
66+
For more information about peering connection lifecycle statuses, check out the
67+
[VPC peering connection lifecycle on AWS][aws-docs-vpc-peering-lifecycle].
68+
69+
</InfoBox>
70+
71+
### Updating security groups
72+
73+
The initial VPC setup will not allow traffic from Cube Cloud; this is because
74+
[the security group][aws-docs-vpc-security-group] for the database will need to
75+
allow access from the Cube Cloud CIDR block.
76+
77+
This can be achieved by adding a new security group rule:
78+
79+
| Protocol | Port Range | Source/Destination |
80+
| -------- | ---------- | --------------------------------------------- |
81+
| TCP | 3306 | The Cube Cloud CIDR block for the AWS region. |
82+
83+
### Update route tables
84+
85+
The final step is to update route tables in your VPC to allow traffic from Cube
86+
Cloud to reach your database. The Cube Cloud CIDR block must be added to the
87+
route tables of all subnets that connect to the database. To do this, follow the
88+
instructions on [the AWS documentation][aws-docs-vpc-peering-routing].
89+
90+
## Troubleshooting
91+
92+
Database connection issues with misconfigured VPCs often manifest as connection
93+
timeouts. If you are experiencing connection issues, please check the following:
94+
95+
- Verify that
96+
[all security groups allow traffic](#setup-updating-security-groups) from the
97+
Cube Cloud provided CIDR block.
98+
- Verify that
99+
[a route exists to the Cube Cloud provided CIDR block](#setup-update-route-tables)
100+
from the subnets that connect to the database.
101+
102+
## Using dedicated pre-aggregation storage
103+
104+
On the Enterprise Premier product tier, you get an option to supply your own S3 bucket to
105+
be used as an underlying storage for Cube Store pre-aggregated data. This
106+
allows you to keep all data at-rest fully within your infrastructure while
107+
still leveraging the full power of the Cube Cloud for managed compute.
108+
109+
To activate this option, simply create an S3 bucket and generate a new AWS
110+
Access Key that would allow full bucket access for Cube Cloud. After it's done,
111+
request the dedicated pre-aggregation storage to be activated from your
112+
Customer Success Manager and share with them the following:
113+
114+
- **AWS Access Key Id**
115+
- **AWS Secret Access Key**
116+
- **S3 Bucket ARN**
117+
118+
[aws-console]: https://console.aws.amazon.com/
119+
[aws-docs-regions]:
120+
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#concepts-available-regions
121+
[aws-docs-vpc]:
122+
https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html
123+
[aws-docs-vpc-peering-accept]:
124+
https://docs.aws.amazon.com/vpc/latest/peering/create-vpc-peering-connection.html#different-account-different-region
125+
[aws-docs-vpc-peering-lifecycle]:
126+
https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html#vpc-peering-lifecycle
127+
[aws-docs-vpc-peering-routing]:
128+
https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-routing.html
129+
[aws-docs-vpc-peering]:
130+
https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html
131+
[aws-docs-vpc-security-group]: https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html
132+
[wiki-cidr-block]:
133+
https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_blocks
134+
135+
## Supported Regions
136+
137+
We support all general-purpose regions. Cube Store is currently located only in
138+
`US East 2` and `EU West 1` so pre-aggregations performance might depend on geographical
139+
proximity to it.

0 commit comments

Comments
 (0)