Before DataWorks can run data synchronization, scheduling, or other tasks, the virtual private cloud (VPC) attached to your resource group must be able to reach your data source. This page describes the six available network connectivity solutions and helps you choose the right one based on where your data source lives.
Prerequisites
Before you begin, ensure that you have:
A resource group with the required specifications. For details, see Use a Serverless resource group.
The solutions on this page apply to Serverless resource groups and the following legacy resource groups: exclusive resource groups for Data Integration, exclusive resource groups for scheduling, and exclusive resource groups for DataService Studio.
Limitations
Serverless resource groups cannot access the public network by default. To reach a data source over the Internet, configure an Internet NAT gateway and elastic IP addresses (EIPs) for the VPC attached to the resource group. For details, see Connect to a data source over the Internet.
Public network connections offer no speed or stability guarantees. For data synchronization, use a private network or Cloud Enterprise Network (CEN).
Network connectivity between a resource group and a data source is required before tasks can run. In a data synchronization flow, the VPC attached to the resource group must be connected to the networks of both the source and the destination.
Resource groups do not support classic network environments. Migrate your data sources and services from a classic network to a VPC before proceeding.
Choose a solution
Your choice depends on where your data source is relative to your DataWorks resource group. Use the table below to identify the right solution, then follow the link to configure it.
| Data source location | Connectivity method | Solution |
|---|---|---|
| Alibaba Cloud product — same account, same region | Deploy in the same VPC | Solution 1 |
| Alibaba Cloud product — same account, different region | CEN or VPC peering connection | Solution 2 |
| Alibaba Cloud product — different account | CEN or VPC peering connection | Solution 3 |
| Data source on an ECS instance | Same VPC (same account/region) or CEN/VPC peering (cross-account/region) | Solution 4 |
| Data source in an on-premises data center | Express Connect | Solution 5 |
| Data source with a public endpoint | Internet NAT gateway + EIPs (Serverless); direct connection (legacy) | Solution 6 |
Solution 1: Connect to an Alibaba Cloud data source in the same account and region
Use this solution if: your data source is an Alibaba Cloud product in the same account and region as your DataWorks workspace.
Deploy the resource group and the data source in the same VPC. This establishes a direct private network connection with no additional networking tools required.
For the full procedure, see Connect to a data source in the same account and region.
Solution 2: Connect to an Alibaba Cloud data source in the same account but a different region
Use this solution if: your data source is an Alibaba Cloud product in the same account as your DataWorks workspace, but in a different region.
Use CEN or a VPC peering connection to connect the resource group VPC to the data source VPC across regions.
For the full procedure, see Connect to a data source in the same account but a different region.
Solution 3: Connect to an Alibaba Cloud data source in a different account
Use this solution if: your data source is an Alibaba Cloud product that belongs to a different Alibaba Cloud account than your DataWorks workspace.
Use CEN or a VPC peering connection to connect the data source VPC (Account A) to the resource group VPC (Account B).
For the full procedure, see Connect to a data source in a different account.
Solution 4: Connect to a data source on an ECS instance
Use this solution if: your data source is deployed on an Alibaba Cloud Elastic Compute Service (ECS) instance.
The connectivity method depends on where the ECS instance is relative to your DataWorks workspace:
Same account and region: Deploy the resource group and the ECS instance in the same VPC.
Different accounts or same account but different regions: Use CEN or a VPC peering connection to connect the resource group VPC to the ECS instance VPC.
Network connection diagrams
Same account and region
Same account, different region
Different accounts
For the full procedure, see Connect to a self-managed data source on an ECS instance.
Solution 5: Connect to a data source in an on-premises data center
Use this solution if: your data source is deployed in an on-premises data center.
Use Express Connect to connect the on-premises network to the resource group VPC over a private link.
For the full procedure, see Connect to a data source in an on-premises data center.
Solution 6: Connect to a data source over the Internet
Use this solution if: your data source has a public endpoint and no private connectivity option is available.
Public network connections offer no speed or stability guarantees. Use a private network or CEN for data synchronization whenever possible.
Serverless resource groups: Cannot access the public network by default. Configure an Internet NAT gateway and EIPs for the VPC attached to the resource group before connecting.
Legacy resource groups: Have EIPs attached by default and can connect to the Internet directly.
Legacy resource groups are being phased out. Use Serverless resource groups.
The diagram below applies only to Serverless resource groups. Legacy resource groups connect directly without additional configuration.
For the full procedure, see Connect to a data source over the Internet.