Create a source connection profile

MySQL   |  PostgreSQL   |  PostgreSQL to AlloyDB

Overview

You can create a connection profile on its own or in the context of creating a specific migration job. Either way, all connection profiles are available for review and modification on the Connection profiles page, and can be reused across migration jobs.

Creating a source connection profile on its own is useful if the person who has the source access information is not the same person who creates the migration job. You can also reuse a source connection profile definition in multiple migration jobs.

To see which source databases Database Migration Service supports, see Supported source and destination databases.

Create a connection profile

1. Go to the Connection profiles page in the Google Cloud Console.
2. Click CREATE PROFILE.
3. Supply the required information for a connection profile:
   1. Populate the section with information required to connect to your source:

   1. Select a Database engine from the drop-down list.

      If you select Cloud SQL for PostgreSQL from this list, then a Cloud SQL instance drop-down list appears. Select the Cloud SQL instance that you want to migrate.

   2. Enter a Connection profile name. This is used in the connection profile list as well as when an existing connection profile is selected in the creation of a migration job.
   3. Keep the auto-generated Connection profile ID.
   4. Enter a Hostname or IP address.

   • If the source database is hosted in Google Cloud or if a reverse SSH tunnel is used to connect the destination database to the source database, then specify the private (internal) IP address for the source database. This address will be accessible by the AlloyDB destination. For more information, see Configure connectivity using VPC peering.

   5. Enter the Port that's used to access the host. The default PostgreSQL port is 5432.
   2. Enter a username and password for the source database. The user must have these privileges.

   3. In the Connection profile region section of the page, select the region where you want to save the connection profile.

      Connection profiles, like all resources, are saved in a region. The connection profile should be created in the same region as the destination AlloyDB instance and the migration job. Region selection can impact availability in the case of regional downtime.

   4. Optional: If the connection is made over an unsecure network, then we recommend using SSL/TLS encryption for the connection between the source and destination databases.

      There are three options for the SSL/TLS configuration that you can select from the Secure your connection section of the page:

      1. None: The AlloyDB destination instance connects to the source database without encryption.

      2. Server-only authentication: When the AlloyDB destination instance connects to the source database, the instance authenticates the source, ensuring that the instance is connecting to the correct host securely. This prevents person-in-the-middle attacks. For server-only authentication, the source doesn't authenticate the instance.

         To use server-only authentication, you must provide the x509 PEM-encoded certificate of the certificate authority (CA) that signed the external server's certificate.

         For more information about creating certificates and keys for your external server, see Secure TCP/IP Connections with SSL.

      3. Server-client authentication: When the destination instance connects to the source, the instance authenticates the source and the source authenticates the instance.

         Server-client authentication provides the strongest security. However, if you don't want to provide the client certificate and private key when you create the AlloyDB destination instance, you can still use server-only authentication.

         To use server-client authentication, you must provide the following items when you create the source connection profile:

         • The certificate of the CA that signed the source database server's certificate (the CA certificate).
         • The certificate used by the instance to authenticate against the source database server (the client certificate).
         • The private key associated with the client certificate (the client key).

         For more information about creating certificates and keys for your source database server, see Secure TCP/IP Connections with SSL.

         If you're having trouble uploading the key, then select the Enter manually option, and copy and paste the key into the text area.

4. Click CREATE at the bottom of the page. The Connection profiles page appears, and the newly created connection profile is displayed.

Previous

Configure your source

Next

Review a migration job

Send feedback