Create a private connectivity configuration for the source database

In this section, you learn how to create a private connectivity configuration. This type of configuration contains information that Database Migration Service uses to communicate with a data source over a private network (internally within Google Cloud, or with external sources connected over VPN or Interconnect). This communication happens through a Virtual Private Cloud (VPC) peering connection.

A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using internal, private IPv4 addresses. You have a private connectivity-based solution to connect to your source Oracle database.

Before you begin

Before you create a private connectivity configuration, make sure that you:

• Have a VPC network that can peer to Database Migration Service's private network and that doesn't have restrictions on it. For more information on creating this network, see Use VPC Network Peering.
• Have an available IP range (with a minimum CIDR block of /29) on the VPC network. Database Migration Service uses this IP range to create a subnet so that it can communicate with the source database.
• Verify that the Google Cloud Platform and/or on-premises firewall allows traffic from the selected IP range.
• Are assigned to a role that contains the compute.networks.list permission. This permission gives you the required IAM permissions to list VPC networks in your project. You can find which roles contain this permission by clicking here.

You can use private connectivity to connect Database Migration Service to any source. However, only VPC networks that are peered directly can communicate with each other.

Transitive peering isn't supported. If the network that Database Migration Service is peered with isn't the network where your source is hosted, you're using a fully managed database, or if Database Migration Service doesn't run on the region where your source exists, then a proxy is required.

If your source is hosted either in another VPC or outside of the Google network, and the VPC network to which Database Migration Service is peered doesn't have direct connectivity to the VPC or network that hosts the source, then you need a reverse proxy.

If you're using a Shared VPC, then you must complete the following actions:

1. On the service project:

   1. Enable the Database Migration Service API.
   2. Obtain the email address used for Database Migration Service's service account. To do so, find the Project number in the Cloud console home page. The email address of the service account will be service-[project_number]@gcp-sa-datamigration.iam.gserviceaccount.com.

2. On the host project:

   1. Grant the COMPUTE.NETWORKADMIN Identity and Access Management (IAM) role permission to Database Migration Service's service account.

Create the configuration

1. Review the required prerequisites to reflect how the environment must be prepared for a private connectivity configuration. For more information about these prerequisites, see Before you begin.

2. Go to the Private connectivity configurations page in the Google Cloud Console.

   Go to the Private connectivity configurations page

3. Click CREATE CONFIGURATION.

4. Use the following table to populate the fields of the Configure private connectivity section of the Create private connectivity configuration page:

   Field	Description
   Configuration name	Enter the display name of the private connectivity configuration.
   Configuration ID	Database Migration Service populates this field automatically based on the configuration name that you enter. You can keep the ID that's auto-generated or change it.
   Region	Select the region where the private connectivity configuration is stored. Private connectivity configurations are saved in a region. Region selection can impact availability if the region experiences downtime. To use a private connection, any migrations and connection profiles that use this configuration must be in the same region.

5. Use the following table to populate the fields of the Set up connection section of the Create private connectivity configuration page:

   Field	Description
   Authorized VPC network	Select the VPC network that you created in Before you begin.
   Allocate an IP range	Enter an available IP range on the VPC network. You determined this IP range in Before you begin.

6. Click CREATE.

   It takes a few minutes for your private connectivity configuration to be created. Background resources need to be created so that the configuration can be created.

After creating a private connectivity configuration, you can view high-level and detailed information about it.