How Applications Communicate with DWS?

Application and DWS Are in the Same VPC in the Same Region

To ensure low latency, you are advised to deploy applications and DWS in the same region. For example, if an application is deployed on an ECS, you are advised to deploy the DWS cluster in the same VPC as the ECS. In this way, the application can directly communicate with DWS through a private IP address. In this case, deploy the data warehouse cluster in the same region and VPC where the ECS resides.

For example, if the ECS is deployed in , select for the DWS cluster and ensure that the DWS cluster and the ECS are both in VPC1. The private IP address of the ECS is 192.168.120.1, the private IP address of DWS is 192.168.120.2. Therefore, they can communicate with each other through private IP addresses.

Perform the following operations to check the ECS outbound rules and DWS inbound rules:

1. Check the ECS outbound rules:

   Ensure that the outbound rule of the ECS security group allows access. If access is not allowed, see .

   

2. Check the DWS inbound rules:

   If no security group is configured when DWS is created, the default inbound rule allows TCP access from all IPv4 addresses and port 8000. To ensure security, you can also allow only one IP address. For details, see

   

3. Log in to the ECS. If the private IP address of DWS can be pinged, the network connection is normal. If the IP address cannot be pinged, check the preceding configuration. If the ECS has a firewall, check the firewall configuration.

Example of using gsql for connection:

gsql -d gaussdb -h 192.168.120.2 -p 8000 -U dbadmin -W password -r

Applications and DWS Are in Different VPCs in the Same Region

To ensure low latency, you are advised to deploy applications and DWS in the same region. For example, if applications are deployed on an ECS, you are advised to deploy the DWS cluster in the same VPC as the ECS. If a different VPC is selected for the DWS cluster, the ECS cannot directly connect to DWS.

For example, both ECS and DWS are deployed in , but ECS is in VPC1 and DWS is in VPC2. In this case, you need to create a between VPC1 and VPC2 so that ECS can access DWS using the private IP address of DWS.

Perform the following operations to check ECS outbound rules, DWS inbound rules, and VPC peering connection between the two VPCs.

1. Check the ECS outbound rules:

   Ensure that the outbound rule of the ECS security group allows access. If access is not allowed, see .

   

2. Check the DWS inbound rules:

   If no security group is configured when DWS is created, the default inbound rule allows TCP access from all IPv4 addresses and port 8000. To ensure security, you can also allow only one IP address. For details, see

   

3. Create a between VPC1 where the ECS is and VPC2 where DWS is.
4. Log in to the ECS. If the private IP address of DWS can be pinged, the network connection is normal. If the IP address cannot be pinged, check the preceding configuration. If the ECS has a firewall, check the firewall configuration.

Example of using gsql for connection:

gsql -d gaussdb -h 192.168.120.2 -p 8000 -U dbadmin -W password -r

Applications and DWS Are in Different Regions

If the application and DWS are in different regions, for example, ECS is in and DWS is in , you need to establish a between the two regions for communication.

Applications are deployed in on-premise data centers and need to communicate with DWS.

If applications are not on the cloud but in the local data center, they need to communicate with DWS on the cloud.

• Scenario 1: On-premises applications communicate with DWS through DWS public IP addresses.

  Example of using gsql for connection:

  gsql -d gaussdb -h public_IP_address -p 8000 -U dbadmin -W password -r

• Scenario 2: On-premises applications cannot access the external network. In this case, use .