Solution 4: Network connectivity for a data source on an ECS instance

Use this solution if your data source meets the following condition.

• The data source is deployed on an Alibaba Cloud ECS instance.

Same account and region

If the ECS instance that hosts your data source and your DataWorks workspace are in the same account and region, we recommend using a VPC connection. You can deploy the resource group for your DataWorks workspace and the ECS instance in the same VPC to establish network connectivity.

Different accounts or regions

If the ECS instance that hosts your data source and your DataWorks workspace are in different accounts or the same account but different regions, we recommend using a VPC connection. Use a network connectivity tool, such as Cloud Enterprise Network (CEN) or a vpc peering connection, to connect the VPC of the DataWorks resource group with the VPC of the ECS instance.

Step 1: Get basic information

Step 2: Establish network connectivity

Step 3: Add a route to the resource group

For cross-account scenarios or same-account cross-region scenarios, you must also add a route in the DataWorks resource group to the vSwitch CIDR block of the ECS instance.

1. Go to the DataWorks resource groups page. Find the target resource group and click Network Settings in the Operation column.

2. Under the relevant feature module, find the bound VPC and click Custom Route in the Operation column.

3. Click Add Route, select CIDR Block for CIDR Block, and set Destination CIDR Block to the vSwitch CIDR block of the ECS instance.

Step 4: (Optional) Enable remote database access

Some databases require you to enable remote access in a configuration file to allow specific users to connect from external sources through an IP address and port. The configuration method varies by database. Refer to the official documentation for your database.

For an example, see 4. Enable remote access for MySQL.

Step 5: Configure the ECS security group

ECS uses security groups for firewall protection. You must add a rule to the security group of the ECS instance to allow access from the DataWorks resource group over the database port.

1. Go to the ECS console and select the region of your target ECS instance in the top navigation bar.

2. In the left-side navigation pane, choose Instances & Images > Instance. Find the ECS instance where your MySQL database is deployed and click the instance name to go to the Instance Details page.

3. Switch to the Security Group tab and click the security group name to go to the Security Group Details page.

4. In the Access Rules section, click Add Rule and configure the following key parameters. Keep the default values for other parameters.

   • Source: Enter the vSwitch CIDR block that is bound to the DataWorks resource group.

   • Port: Enter the port of the database on your ECS instance. For example, port 3306 must be open for MySQL.

1. Basic information

2. Establish network connectivity

This example uses a vpc peering connection to establish network connectivity between the ECS instance and DataWorks.

1. Log on to Account A and go to the VPC Peering Connection console. In the top navigation bar, select the China (Hangzhou) region, then click Create Peering Connection and configure the parameters.

   The following table describes the key parameters for this example. Keep the default values for other parameters.

   Parameter	Configuration and example
   Peering connection name	Enter a custom name. For this example, set it to Account_A to Account_B.
   Requester VPC	In this example, the VPC that contains the ECS instance in Account A is Account_A_hangzhou_VPC.
   Accepter account type	In this example, select Cross-account.
   Accepter Alibaba Cloud account UID	Enter the UID of the main account for Account B.
   Accepter region type	This example selects Cross-region.
   Accepter region	For the region of the DataWorks workspace and resource group in Account B, select China (Shanghai).
   Accepter VPC	Manually enter the VPC ID of the VPC (Account_B_shanghai_VPC) that contains the DataWorks resource group in Account B.

2. Click Determine to complete the peering connection configuration. You are automatically redirected to the peering connection's basic information page. At this point, the Status of the peering connection is Accepting.

3. Log on to Account B and go to the VPC Peering Connection console. In the top navigation bar, select the China (Shanghai) region. Find the peering connection request and click Receiver in the Operation column. After you accept the request, the Status of the peering connection changes to Activated.

4. Click Configure Route Entry under Destination VPC Instance. In the Configure Route Entry dialog box, specify a Name and set Destination CIDR Block to the VPC CIDR block of the source (ECS). In this example, the value is 192.168.0.0/16.

5. Log on to Account A and go to the VPC Peering Connection console. In the top navigation bar, select the China (Hangzhou) region and find the peering connection that you created.

6. Click Configure Route Entry under Source VPC Instance. In the Configure Route Entry dialog box, enter a custom Name, and set Destination CIDR Block to the VPC CIDR block of the destination (DataWorks resource group). In this example, the value is set to 172.16.0.0/12.

3. Add a route to the resource group

1. Log on to Account B and go to the DataWorks resource groups page. Find the target resource group and click Network Settings in the Operation column.

2. Under the relevant feature module, find the bound VPC and click Custom Route in the Operation column.

3. Click Add Route, set the connection method to CIDR Block, and set Destination CIDR Block to the vSwitch CIDR block of the ECS instance (in this example, 192.168.6.0/24).

4. Enable remote access for MySQL

Connect to the ECS instance where the MySQL database is deployed and enable remote access for the database.

1. Find the location of the my.cnf configuration file (the default location is /etc/my.cnf).

   find / -name my.cnf

2. Run the vim /etc/my.cnf command to edit the configuration file (replace the my.cnf path with the actual path from the previous step).

3. At the end of the configuration file, press the i key to add the following configuration under [mysqld]:

   bind-address=0.0.0.0

4. Press Esc, then type :wq! to save and exit.

5. Run the systemctl restart mysqld command to restart the service.

6. Create a database user for the DataWorks remote connection.

   1. Use the mysql -u root -p command to log in to the database as an administrator.

   2. Create a user and set a password.

      -- "dataworks_user" is the username, which you can customize.
      -- "%" allows access from any IP address. You can also specify an IP address for fine-grained control.
      -- "StrongPassword123!" is the user's password, which you can customize.
      CREATE USER 'dataworks_user'@'%' IDENTIFIED BY 'StrongPassword123!';

   3. Grant database permissions to the user.

      -- Run one of the following commands.
      
      -- Grant all privileges to the user. Use with caution.
      GRANT ALL PRIVILEGES ON *.* TO 'dataworks_user'@'%' WITH GRANT OPTION;
      
      -- Grant the user privileges on a specific database, such as mydatabase.
      GRANT ALL PRIVILEGES ON mydatabase.* TO 'dataworks_user'@'%' WITH GRANT OPTION;

   4. Run the FLUSH PRIVILEGES; command to flush the privileges, and then exit the database (exit).

   5. Verify the remote connection.

      mysql -u dataworks_user -h <ECS_private_IP_address> -p

5. Configure the ECS security group

1. Log on to Account A and go to the ECS console. In the top navigation bar, select the China (Hangzhou) region.

2. In the left-side navigation pane, choose Instances & Images > Instance. Find the ECS instance where your MySQL database is deployed and click the instance name to go to the Instance Details page.

3. Switch to the Security Group tab and click the security group name to go to the Security Group Details page.

4. In the Access Rules section, click Add Rule and configure the following key parameters. Keep the default values for other parameters.

   • Source: Enter the vSwitch CIDR block of the DataWorks resource group (for example, 172.16.66.0/24).

   • Port: Select the port for the database deployed on the ECS instance (in this case, 3306).

6. Test connectivity

1. Log on to Account B.

2. Log on to the DataWorks console. In the target region, click Data Integration > Data Integration in the left-side navigation pane. Select a workspace from the drop-down list and click Go to Data Integration.

3. In the left-side navigation pane, click Data Sources to go to the Data Sources page, and then click Add Connection.

4. Select the MySQL data source type and configure its connection parameters.

   • For Configuration Mode, select User-created Data Store with Public IP Addresses.

   • For Host Address ID, enter the private IP address of the ECS instance (in this example, 192.168.6.172).

   • Set Port Number to 3306.

   • For Database Name, enter the name of your existing database.

   • Set Username and Password to the username and password of the dataworks_user user that were created in the 4. Enable remote access for the MySQL database step.

5. In the Connection Configuration section, select the resource group and click Test Connectivity. Confirm that the connectivity status is Connectable.

   In the Connection Configuration section of the data source, select a resource group, click Test Connectivity, and confirm that the connectivity status is Connected.

   Note

   If the test result shows Failed, use the Network Connectivity Diagnostic Tool to troubleshoot. If connectivity still fails, submit a ticket for assistance.