You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
To avoid exposing a database in AWS to the public internet, AWS Private Endpoints ([AWS PrivateLink](https://aws.amazon.com/privatelink/)) is an option that provides private networking between the source database and the PowerSync Service. Private Endpoints are currently available on our [Team and Enterprise plans](https://www.powersync.com/pricing).
8
8
9
+
We use Private Endpoints instead of VPC Peering, to avoid exposing any other resources between the VPCs.
9
10
10
11
<Warning>
11
12
Do not rely on Private Endpoints as the only form of security. Always use strong database passwords, and use client certificates if additional security is required.
12
13
</Warning>
13
14
14
15
## Current Limitations
15
16
16
-
1. Private Endpoints are only supported for Postgres instances currently. [Contact us](/resources/contact-us) if you need this for MongoDB or MySQL.
17
-
2. The guide below does not handle dynamic IPs if the RDS instance's IP changes. This needs additional work to automatically update the IP - see this [AWS blog post](https://aws.amazon.com/blogs/database/access-amazon-rds-across-vpcs-using-aws-privatelink-and-network-load-balancer/) on the topic. This is specifically relevant if using a RDS cluster with failover support.
18
-
3. Self-service is not yet available on the PowerSync side - contact PowerSync support to configure the instance.
19
-
4. Only AWS is supported currently, other cloud providers are not supported yet.
20
-
21
-
## Endpoint Service Setup
22
-
23
-
To configure a Private Endpoint Service, a network load balancer is required to forward traffic to the database. Use the following steps:
24
-
1. Create a Target Group for the Network Load Balancer:
25
-
1. Obtain the RDS Instance's private IP address. Make sure this points to a writable instance.
26
-
2. Create a Target Group with IP addresses as target type, using the IP address from above. Use TCP protocol, and specify the database port (typically 5432 for Postgres).
27
-
3. Note: The IP address of your RDS instance may change over time. To maintain a consistent connection, consider implementing automation to monitor and update the target group's IP address as needed. See the [AWS blog post](https://aws.amazon.com/blogs/database/access-amazon-rds-across-vpcs-using-aws-privatelink-and-network-load-balancer/) on the topic.
28
-
2. Create a Network Load Balancer (NLB):
29
-
1. Select the same VPC as your RDS instance.
30
-
2. Choose at least two subnets in different availability zones.
31
-
3. Configure a TCP listener and pick a port (for example 5432 again).
32
-
4. Associate the listener with the target group created earlier.
33
-
3. Modify the security group associated with your RDS instance to permit traffic from the load balancer.
34
-
4. Create a VPC Endpoint Service:
35
-
1. In the AWS Management Console, navigate to the VPC service and select Endpoint Services.
36
-
2. Click on "Create Endpoint Service".
37
-
3. Select the Network Load Balancer created in the previous step.
38
-
4. If the load balancer is in one of the PowerSync regions (see below), it is not required to select any "Supported Region". If the load balancer is in a different region, select the region corresponding to your PowerSync instance here. Note that this will incur additional AWS charges.
39
-
5. Decide whether to require acceptance for endpoint connections. Disabling acceptance can simplify the process but may reduce control over connections.
40
-
6. Under "Supported IP address types", select both IPv4 and IPv6.
41
-
7. After creating the endpoint service, note the Service Name. This identifier will be used when configuring PowerSync to connect via PrivateLink.
42
-
8. Configure the Endpoint Service to accept connections from the principal `arn:aws:iam::131569880293:root`. See the [AWS documentation](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#add-remove-permissions) for details.
43
-
44
-
## PowerSync Setup
17
+
1. Private Endpoints are currently only supported for Postgres and MongoDB instances. [Contact us](/resources/contact-us) if you need this for MySQL.
18
+
2. Self-service is not yet available on the PowerSync side - contact PowerSync support to configure the instance.
19
+
3. Only AWS is supported currently, other cloud providers are not supported yet.
20
+
4. "Test Connection" on the dashboard is not supported yet - the instance has to be deployed to test the connection.
21
+
22
+
## Concepts
23
+
24
+
* AWS PrivateLink is the overarching feature on AWS.
25
+
26
+
* VPC/Private Endpoint Service is the service that exposes the database, and lives in the same VPC as the source database. It provides a one-way connection to the specific database, without exposing any other resources in the VPC.
27
+
* Endpoint Service Name is an unique identifier for this Endpoint Service.
28
+
* Each Endpoint Service may have multiple Private Endpoints in different VPCs.
29
+
30
+
* VPC/Private Endpoint is the endpoint in the PowerSync VPC. This is what the PowerSync instance connects to.
31
+
32
+
For custom Endpoint Services for Postgres:
33
+
* Network Load Balancer (NLB) is a load balancer that exposes the source database to the Endpoint Service.
34
+
* Target Group specifies the IPs and ports for the Network Load Balancer to expose.
35
+
* Listener for the Network Load Balancer is what describes the incoming port on the Network Load Balancer (the port that the PowerSync instance connects to).
36
+
37
+
## Private Endpoint Setup
38
+
39
+
<AccordionGroup>
40
+
<Accordiontitle="AWS PrivateLink in MongoDB Atlas">
41
+
42
+
MongoDB Atlas supports creating an Endpoint Service per project for AWS.
43
+
44
+
Limitations:
45
+
1. Only Atlas clusters in AWS are supported.
46
+
2. The Atlas cluster must be in one of the PowerSync AWS regions - see the list below. Cross-region endpoints are not yet supported by MongoDB Atlas.
47
+
48
+
### 1. Configure the Endpoint Service
49
+
50
+
1. In the Atlas project dashboard, go to Network Access -> Private Endpoint -> Dedicated Cluster.
51
+
2. Select "Add Private Endpoint".
52
+
3. Select AWS and the relevant AWS region.
53
+
4. Wait for the Endpoint Service to be created.
54
+
5. "Your VPC ID" and "Your Subnet IDs" are not relevant for PowerSync - leave those blank.
55
+
6. Do not run the command to create the "VPC Interface Endpoint" - this is done on the PowerSync side.
56
+
7. Note the Endpoint Service Name. This is displayed in the command to run, as the `--service-name` option.
57
+
58
+
The Service Name should look something like `com.amazonaws.vpce.us-east-1.vpce-svc-0123456`.
59
+
60
+
### 2. Get the connection string
61
+
62
+
1. On the Atlas Cluster, select "Connect".
63
+
2. Select "Private Endpoint" as the connection type.
64
+
3. Select "Drivers" as the connection method, and copy the connection string.
65
+
66
+
The connection string should look something like `mongodb+srv://<db_username>:<db_password>@your-cluster-pl-0.abcde.mongodb.net/`.
67
+
68
+
69
+
### 3. PowerSync Setup
70
+
71
+
On PowerSync, create a new instance, but do not configure the connection yet. Copy the Instance ID.
72
+
73
+
[Contact us](/resources/contact-us) and provide:
74
+
1. The Endpoint Service Name.
75
+
2. The MongoDB connection string.
76
+
3. The PowerSync Instance ID.
77
+
78
+
We will then configure the instance to use the Endpoint Service for the database connection, and provide you with a VPC Endpoint ID, in the form `vpce-12346`.
79
+
80
+
### 4. Finish Atlas Endpoint Service Setup
81
+
82
+
On the Atlas Private Endpoint Configuration, in the final step, specify the VPC Endpoint ID from above.
83
+
If you have already closed the dialog, go through the process of creating a Private Endpoint again. It should have the same Endpoint Service Name as before.
84
+
85
+
Check that the Endpoint Status changes to Available.
86
+
87
+
### 5. Deploy
88
+
89
+
Once the Private Endpoint has been created on the PowerSync side, it will be visible in the instance settings
90
+
under the connection details, as "VPC Endpoint Hostname".
91
+
92
+
Verify the connection details, and deploy the instance. Monitor the logs to ensure the instance can connect after deploying.
93
+
94
+
95
+
</Accordion>
96
+
<Accordiontitle="Custom Endpoint Service for Postgres">
97
+
98
+
To configure a Private Endpoint Service, a network load balancer is required to forward traffic to the database.
99
+
100
+
This can be used with a Postgres database running on an EC2 instance, or a RDS instance.
101
+
102
+
For AWS RDS, the guide below does not handle dynamic IPs if the RDS instance's IP changes. This needs additional work to automatically update the IP - see this [AWS blog post](https://aws.amazon.com/blogs/database/access-amazon-rds-across-vpcs-using-aws-privatelink-and-network-load-balancer/) on the topic. This is specifically relevant if using a RDS cluster with failover support.
103
+
104
+
Use the following steps to configure the Endpoint Service:
105
+
106
+
### 1. Create a Target Group
107
+
108
+
1. Obtain the RDS Instance's private IP address. Make sure this points to a writable instance.
109
+
2. Create a Target Group with IP addresses as target type, using the IP address from above. Use TCP protocol, and specify the database port (typically 5432 for Postgres).
110
+
3. Note: The IP address of your RDS instance may change over time. To maintain a consistent connection, consider implementing automation to monitor and update the target group's IP address as needed. See the [AWS blog post](https://aws.amazon.com/blogs/database/access-amazon-rds-across-vpcs-using-aws-privatelink-and-network-load-balancer/) on the topic.
111
+
112
+
### 2. Create a Network Load Balancer (NLB)
113
+
114
+
1. Select the same VPC as your RDS instance.
115
+
2. Choose at least two subnets in different availability zones.
116
+
3. Configure a TCP listener and pick a port (for example 5432 again).
117
+
4. Associate the listener with the target group created earlier.
118
+
119
+
### 3. Modify the security group
120
+
121
+
1. Modify the security group associated with your RDS instance to permit traffic from the load balancer IP range.
122
+
123
+
### 4. Create a VPC Endpoint Service
124
+
125
+
1. In the AWS Management Console, navigate to the VPC service and select Endpoint Services.
126
+
2. Click on "Create Endpoint Service".
127
+
3. Select the Network Load Balancer created in the previous step.
128
+
4. If the load balancer is in one of the PowerSync regions (see below), it is not required to select any "Supported Region". If the load balancer is in a different region, select the region corresponding to your PowerSync instance here. Note that this will incur additional AWS charges for the cross-region support.
129
+
5. Decide whether to require acceptance for endpoint connections. Disabling acceptance can simplify the process but may reduce control over connections.
130
+
6. Under "Supported IP address types", select both IPv4 and IPv6.
131
+
7. After creating the endpoint service, note the Service Name. This identifier will be used when configuring PowerSync to connect via PrivateLink.
132
+
8. Configure the Endpoint Service to accept connections from the principal `arn:aws:iam::131569880293:root`. See the [AWS documentation](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#add-remove-permissions) for details.
133
+
134
+
135
+
### 5. PowerSync Setup
45
136
46
137
On PowerSync, create a new instance, but do not configure the connection yet.
47
138
48
139
[Contact us](/resources/contact-us) and provide the Service Name from above, as well as the PowerSync instance ID created above. We will then configure the instance to use the Endpoint Service for the database connection.
49
140
141
+
### 6. Deploy
142
+
143
+
Once the Private Endpoint has been created on the PowerSync side, it will be visible in the instance settings
144
+
under the connection details, as "VPC Endpoint Hostname".
145
+
146
+
Verify the connection details, and deploy the instance. Monitor the logs to ensure the instance can connect after deploying.
147
+
148
+
149
+
</Accordion>
150
+
</AccordionGroup>
151
+
50
152
## AWS Regions
51
153
52
154
PowerSync currently runs in the AWS regions below. Make sure the region matching your PowerSync instance is supported in by the Endpoint Service.
0 commit comments