Database Migration Service 使用
Private Service Connect 通过专用 IP 地址连接到目标 AlloyDB for PostgreSQL 实例。借助 Private Service Connect，您可以将目标数据库公开给传入的安全连接，并控制哪些人可以访问该数据库。此连接由 Database Migration Service 加密。
Private Service Connect 的网络架构设置因您使用的是已启用 PSC 的 AlloyDB for PostgreSQL 目标实例还是未启用 PSC 的 AlloyDB for PostgreSQL 目标实例而异。
对于已启用 PSC 的 AlloyDB for PostgreSQL 集群
为目标 AlloyDB for PostgreSQL 实例使用专用 IP 连接的最简单方法是创建已启用 PSC 的 AlloyDB for PostgreSQL 实例。
图 2. 迁移网络示例：公共 IP 源连接。（点击可放大）
启用 PSC 的集群的要求
如需使用已启用 PSC 的 AlloyDB for PostgreSQL 集群，您需要创建已启用 PSC 的目标实例。存在以下限制：
功能限制
已启用 PSC 的 AlloyDB for PostgreSQL 集群存在某些功能限制。确保此类配置符合您的要求。请参阅 AlloyDB for PostgreSQL 文档中的
Private Service Connect 限制。
创建限制
您只能使用 gcloud 或 AlloyDB for PostgreSQL API 创建已启用 PSC 的 AlloyDB for PostgreSQL 集群。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-05。"],[],[],null,["# Networking methods for destination database connectivity\n\nDatabase Migration Service can connect to your destination cluster's public or private IP\naddress. This page provides an overview of each available destination database\nconnectivity method, as well as a recommendation section to help you choose\nthe right solution for your migration:\n\n- [Method comparison](#methods-comparison) provides a comparison table for available\n destination connectivity methods.\n\n- [Public IP connectivity](#public-ip) describes destination connectivity over\n public internet.\n\n- [Private IP connectivity](#private-ip) explains how Database Migration Service uses\n Private Service Connect to connect to the private IP of your\n destination cluster.\n\nAfter you familiarize yourself with different connectivity methods and their\nrequirements, you can use the\n[decision tree diagram](#decision-tree) to pick the right solution for your scenario.\n\nMethod comparison\n-----------------\n\nEvery destination connectivity method comes with different benefits and requirements.\nUse the following table to compare them at a glance, and then learn more\ndetails in the sections dedicated for each method.\n\nPublic IP connectivity\n----------------------\n\nWhen you use the public IP connectivity method, Database Migration Service attempts\nto establish a connection to the public IP address of your destination\nAlloyDB for PostgreSQL instance. This connection is encrypted and secured\nby Database Migration Service.\n[](#lightbox-trigger) **Figure 1.** Migration networking example: public IP destination connectivity. (click to enlarge)\n\n### Requirements for public IP connectivity\n\nTo use this connectivity method you need to ensure that your destination\nAlloyDB for PostgreSQL instance has a public IP address enabled. For more information, see\n[Configure public IP](/alloydb/docs/connect-public-ip#enable-ip) in the AlloyDB for PostgreSQL documentation.\n\n### Configure IP allowlist connectivity\n\nConfiguring public IP connectivity is covered in\n[Configure public IP connectivity](/database-migration/docs/oracle-to-alloydb/configure-dst-connection-public-ip).\n\nPrivate IP connectivity\n-----------------------\n\nDatabase Migration Service uses [Private Service Connect](/vpc/docs/private-service-connect) to connect to your destination\nAlloyDB for PostgreSQL instance using a private IP address.\nWith Private Service Connect, you can expose your destination\ndatabase to incoming secure connections, and control who can access the database.\nThis connection is encrypted by Database Migration Service.\n\nNetwork architecture setup for Private Service Connect differs\ndepending on whether you use a PSC-enabled or a non-PSC-enabled destination\nAlloyDB for PostgreSQL instance.\n\n### For PSC-enabled AlloyDB for PostgreSQL clusters\n\nThe easiest way to use private IP connectivity for destination AlloyDB for PostgreSQL\ninstances is to create a PSC-enabled AlloyDB for PostgreSQL instance.\n[](#lightbox-trigger) **Figure 2.** Migration networking example: public IP source connectivity. (click to enlarge)\n\n#### Requirements for PSC-enabled clusters\n\nTo use PSC-enabled AlloyDB for PostgreSQL clusters, you need to create the destination\ninstance with PSC enabled. The following limitations apply:\n\n- **Functionality limitations**\n\n PSC-enabled AlloyDB for PostgreSQL clusters come with\n certain functionality limitations. Make sure such configurations meet your\n requirements. See\n [Private Service Connect limitations](/alloydb/docs/configure-private-service-connect#limitations) in\n AlloyDB for PostgreSQL documentation.\n- **Creation limitations**\n\n You can create PSC-enabled AlloyDB for PostgreSQL clusters only with\n `gcloud` or the AlloyDB for PostgreSQL API.\n\n#### Configure private connectivity for PSC-enabled clusters\n\nConfiguring private IP connectivity is covered in\n[Configure private IP connectivity for PSC-enabled clusters](/database-migration/docs/oracle-to-alloydb/configure-dst-connection-private-ip#psc-enabled).\n\n### For non-PSC-enabled clusters\n\nYou can use private IP connectivity even if you can't use a PSC-enabled\nAlloyDB for PostgreSQL instance as your destination database. The configuration is more\ncomplex, as it requires an additional bastion virtual machine (VM) in your\nnetwork to forward traffic between Database Migration Service and your destination's\nprivate IP.\n[](#lightbox-trigger) **Figure 3.** Migration networking example: public IP source connectivity. (click to enlarge)\n\n#### Requirements for non-PSC-enabled clusters\n\nPrivate IP connectivity for non-PSC-enabled AlloyDB for PostgreSQL clusters\nrequires the following:\n\n- You need to have a [Virtual Private Cloud network with private services access enabled](/vpc/docs/configure-private-services-access).\n\n This is the network that you peer with your AlloyDB for PostgreSQL destination cluster.\n- Your destination AlloyDB for PostgreSQL must have private IP enabled.\n\n- Additionally, you need to be able to create the following network components\n in your project:\n\n - A service attachment: A network resource that exposes destination\n AlloyDB for PostgreSQL private IP to other services in a Google Cloud VPC network.\n The Google Cloud project where you create the service attachment is\n the *service producer* . The *service consumer* is Database Migration Service.\n\n - PSC forwarding rules: A rule that routes the incoming traffic\n from the service attachment to the dedicated bastion VM.\n\n - A bastion VM: A Compute Engine VM with two network interface controllers\n (NICs). One is attached to the dedicated service attachment network; the other,\n to the network where AlloyDB for PostgreSQL is peered. The bastion VM runs\n a Dante SOCKS server to forward the connections.\n\n#### Configure private connectivity for non-PSC-enabled clusters\n\nConfiguring private IP connectivity is covered in\n[Configure private IP connectivity for non-PSC enabled instances](/database-migration/docs/oracle-to-alloydb/configure-dst-connection-private-ip#non-psc).\n\nDestination network connectivity decision tree\n----------------------------------------------\n\nWhen you are familiar with all supported destination connectivity methods\nand their requirements, you can follow the questions in the diagram\nto help you pick the right connectivity method for your scenario.\n**Figure 4.** Destination network connectivity decision tree.\n\nWhat's next\n-----------\n\n- Learn about source database connectivity. See\n [Networking methods for source database connectivity](/database-migration/docs/oracle-to-alloydb/networking-methods-source).\n\n- To get a complete, step-by-step migration walkthrough, see\n [Oracle to AlloyDB for PostgreSQL migration guide](/database-migration/docs/oracle-to-alloydb/guide)."]]
