How Applications Communicate with DWS?

Service Application and DWS Are in the Same VPC in the Same Region

To ensure low service latency, you are advised to deploy service applications and DWS in the same region. For example, if a service application is deployed on an ECS, you are advised to deploy the data warehouse cluster in the same VPC as the ECS. In this way, the application can directly communicate with DWS through an intranet IP address. In this case, deploy the data warehouse cluster in the same region and VPC where the ECS resides.

For example, if the ECS is deployed in CN-Hong Kong, select CN-Hong Kong for the DWS cluster and ensure that the DWS cluster and the ECS are both in VPC1. The private IP address of the ECS is 192.168.120.1, the private IP address of DWS is 192.168.120.2. Therefore, they can communicate with each other through private IP addresses.

The key points in communication check are the ECS outbound rule and DWS inbound rule. The check procedure is as follows:

1. Check the ECS outbound rules:

   Ensure that the outbound rule of the ECS security group allows access. If access is not allowed, see Configuring Security Group Rules.

   

2. Check the DWS inbound rules:

   If no security group is configured when DWS is created, the default inbound rule allows TCP access from all IPv4 addresses and port 8000. To ensure security, you can also allow only one IP address. For details, see How Do I Configure a Whitelist to Protect Clusters Available Through a Public IP Address?

   

3. Log in to the ECS. If the internal IP address of DWS can be pinged, the network connection is normal. If the IP address cannot be pinged, check the preceding configuration. If the ECS has a firewall, check the firewall configuration.

Example of using gsql for connection:

gsql -d gaussdb -h 192.168.120.2 -p 8000 -U dbadmin -W password -r

Figure 1 Access via Private IP addresses

Service Applications and DWS Are in Different VPCs in the Same Region

To ensure low service latency, you are advised to deploy service applications and DWS in the same region. For example, if service applications are deployed on an ECS, you are advised to deploy the data warehouse cluster in the same VPC as the ECS. If a different VPC is selected for the data warehouse cluster, the ECS cannot directly connect to DWS.

For example, both ECS and DWS are deployed in CN-Hong Kong, but ECS is in VPC 1 and DWS is in VPC 2. In this case, you need to create a VPC peering connection between VPC 1 and VPC 2 so that ECS can access DWS using the private IP address of DWS.

The key points for checking the communication are the ECS outbound rules, DWS inbound rules, and VPC peering connection. The check procedure is as follows:

1. Check the ECS outbound rules:

   Ensure that the outbound rule of the ECS security group allows access. If access is not allowed, see Configuring Security Group Rules.

   

2. Check the DWS inbound rules:

   If no security group is configured when DWS is created, the default inbound rule allows TCP access from all IPv4 addresses and port 8000. To ensure security, you can also allow only one IP address. For details, see How Do I Configure a Whitelist to Protect Clusters Available Through a Public IP Address?

   

3. Create a VPC peering connection between VPC 1 where the ECS is and VPC 2 where DWS is.
4. Log in to the ECS. If the internal IP address of DWS can be pinged, the network connection is normal. If the IP address cannot be pinged, check the preceding configuration. If the ECS has a firewall, check the firewall configuration.

Example of using gsql for connection:

gsql -d gaussdb -h 192.168.120.2 -p 8000 -U dbadmin -W password -r

Figure 2 Access via VPC peering

Service Applications and DWS Are in Different Regions

If the service application and DWS are in different regions, for example, ECS is in CN-Hong Kong and DWS is in AP-Singapore, you need to establish a Cloud Connect between the two regions for communication.

Figure 3 Access via cloud connect

Service applications are deployed in on-premise data centers and need to communicate with DWS.

If service applications are not on the cloud but in the local data center, they need to communicate with DWS on the cloud.

• Scenario 1: On-premises service applications communicate with DWS through DWS public IP addresses.

  Example of using gsql for connection:

  gsql -d gaussdb -h public_IP_address -p 8000 -U dbadmin -W password -r

  Figure 4 Access via public IP addresses
  

• Scenario 2: On-premises services cannot access the external network. In this case, use Direct Connect.
  Figure 5 Access via direct connect