## Set up a private network link to Microsoft SQL Server on Amazon EC2

URL: https://docs.atlan.com/apps/connectors/database/microsoft-sql-server/how-tos/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-ec2

> :::warning Who can do this? You will need your AWS administrator to complete these tasks - you may not have access yourself.

:::warning Who can do this?
 You will need your AWS administrator to complete these tasks - you may not have access yourself.

:::

[AWS PrivateLink](https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-privatelink.html) creates a secure, private connection between services running in AWS. This document describes the steps to set this up between Microsoft SQL Server on Amazon EC2 and Atlan.

## Prerequisites

You should already have the following:

- Your own non-default VPC configured in AWS.
- A Microsoft SQL Server on Amazon EC2 instance running in AWS, linked to the non-default VPC.
- Private subnets defined within the non-default VPC sufficient for availability.

:::info **Did you know?** 
 You will also need Atlan's AWS account ID later in this process. If you do not already have this, [request it now from Atlan support](https://docs.atlan.com/support/submit-request).

:::

## Create security group

You will need to create a security group for the following:

- [Microsoft SQL Server on Amazon EC2 instance](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-ec2/llms.txt)
- [Network Load Balancer](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-ec2/llms.txt) (NLB)

### Microsoft SQL Server on Amazon EC2 instance

You can either create a new security group or add the following rule to an existing security group already attached to your Microsoft SQL Server on Amazon EC2 instance.

To create a security group for your Microsoft SQL Server on Amazon EC2 instance:

1. Open the [Amazon VPC console](https://console.aws.amazon.com/vpc/).
2. From the left menu, under _Security_, click **Security Groups**.
3. Click the **Create security group** button.
4. Enter a name and description for the new security group.
5. From the _VPC_ list, select the VPC where your Microsoft SQL Server on Amazon EC2 instance is located.
6. For _Inbound rules_, leave this blank until after you have [created a security group for the Network Load Balancer](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-ec2/llms.txt). Return to this step once you have created it, click the **Add rule** button, and then add the following rule: 
 1. For _Type_, use **MSSQL** if you are using the default port (1433), or use **Custom** and enter your port under _Port range_.
 2. For _Destination_, add the [security group you created for the NLB](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-ec2/llms.txt).
7. Click **Create security group** to finish setup.

### Network Load Balancer

To create a security group for the Network Load Balancer:

1. Open the [Amazon VPC console](https://console.aws.amazon.com/vpc/).
2. From the left menu, under _Security_, click **Security Groups**.
3. Click the **Create security group** button.
4. Enter a name and description for the new security group.
5. From the _VPC_ list, select the VPC where your Microsoft SQL Server on Amazon EC2 instance is located.
6. For _Outbound rules_, click the **Add rule** button and then add the following rule: 
 1. For _Type_, use **MSSQL** if you are using the default port (1433), or use **Custom** and enter your port under _Port range_.
 2. For _Destination_, add the [security group you created for your Microsoft SQL Server on Amazon EC2 instance](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-ec2/llms.txt).
 3. Click **Save**.
7. Click **Create security group** to finish setup.

## Create a target group

To create a target group for the NLB:

1. Open the [Amazon EC2 console](https://console.aws.amazon.com/ec2/).
2. From the left menu, under _Load Balancing_, click **Target Groups**.
3. Click **Create target group**.
4. For _Basic configuration_, enter the following details:
 1. For _Choose a target type_, keep **Instances**.
 2. For _Target group name_, enter a unique name for the new target group.
 3. For _Protocol_, select **TCP**.
 4. For _Port_, enter **1433**.
 5. For _IP address type_, select **IPv4**.
 6. For _VPC_, select the VPC where your Microsoft SQL Server on Amazon EC2 instance is located.
5. In the _Health checks_ section, change the protocol to **TCP** and keep **Advanced health check settings** as the default.
6. Click **Next** to proceed.
7. To register your Amazon EC2 instance, on the _Register targets_ page:
 1. For _Available instances_, select your Amazon EC2 instance running Microsoft SQL Server.
 2. Keep the default port **1433** and then choose **Include as pending below**.
8. At the bottom of the form, click the **Create target group** button.

## Create internal Network Load Balancer

To create an NLB:

1. Open the [Amazon EC2 console](https://console.aws.amazon.com/ec2/).
2. From the left menu, under _Load Balancing_, click **Load Balancers**.
3. At the top of the screen, click the **Create Load Balancer** button.
4. Under the _Network Load Balancer_ option, click the **Create** button.
5. Enter the following _Basic configuration_ settings for the load balancer:
 1. For _Load balancer name_, enter a unique name.
 2. For _Scheme_, select **Internal**.
 3. For _IP address type_, select **IPv4**.
6. Enter the following _Network mapping_ settings for the load balancer:
 1. For _VPC_, select the VPC where your Microsoft SQL Server on Amazon EC2 instance is located.
 2. For _Mappings_, select the availability zones with private subnets.
7. For _Security groups_, select the security group you created for the Network Load Balancer.

 :::info

 💪 **Did you know?** The **Enforce inbound rules on PrivateLink traffic** setting is turned on by default and cannot be modified until after the load balancer has been created. If this setting is left on, you will need to [contact Atlan support](https://docs.atlan.com/support/submit-request) and request the CIDR range of Atlan's cluster to add as an inbound rule on the [NLB security group](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-ec2/llms.txt). To turn it off, follow [these instructions](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-security-groups.html#update-security-settings).

 :::

8. Enter the following _Listeners and routing_ settings for the load balancer:
 1. For _Protocol_, select **TCP**.
 2. For _Port_, enter **1433**.
 3. For _Target group_, select the target group you created.
9. Review your configuration, and click **Create load balancer**.

## Verify target group is healthy

To verify that the target group is healthy:

1. From the EC2 menu on the left, under _Load Balancing_, click **Target Groups**.
2. From the _Target groups_ table, click the link to the target group you created above.
3. At the bottom of the screen, under the _Details_ tab, check that there is a 1 under both _Total targets_ and _Healthy_. (Note: This number could be more than 1 if you have a multi-node deployment.)

## Create endpoint service

To create an endpoint service:

1. Open the [Amazon VPC console](https://console.aws.amazon.com/vpc/).
2. From the left menu, under _Virtual private cloud_, click **Endpoint services**.
3. At the top of the page, click the **Create endpoint service** button.
4. Enter the following _Endpoint service_ _settings_:
 1. For _Name_, enter a meaningful name.
 2. For _Load balancer type_, choose **Network**.
5. For _Available load balancers_, select the load balancer you created above.
6. Enter the following _Additional settings_:
 1. For _Require acceptance for endpoint_, enable **Acceptance required** to require manual acceptance of connection requests to your endpoint service. Otherwise, these requests will be accepted automatically.
 2. For _Enable private DNS name_, leave unchecked.
 3. For _Supported IP address types_, enable **IPv4**.
7. At the bottom of the form, click the **Create** button.
8. Once the endpoint service has been created, navigate to the _Details_ page. From the _Details_ page:
 1. Under _Service Name_, copy the value to send to Atlan.
 2. Under _Availability Zones_, copy the zones to send to Atlan.

## Allow Atlan account access

To allow Atlan's account access to the service, from within the endpoint service screen:

1. At the bottom of the screen, change to the **Allow principals** tab.
2. At the top of the _Allow principals_ table, click the **Allow principals** button.
3. Under _Principals to add_ and _ARN_, enter the Atlan account ID and root principal - for example, `arn:aws:iam::<account_id>:root`.
4. At the bottom of the form, click the **Allow principals** button.

## Notify Atlan support

Once all of the above steps have been completed, [contact Atlan support](https://docs.atlan.com/support/submit-request) and provide the following details:

- [Service name of the endpoint service](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-ec2/llms.txt)
- [Availability zones for the endpoint service](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-ec2/llms.txt)

There are additional steps Atlan then needs to complete:

- Creating a security group.
- Creating an endpoint.

Once the Atlan team has confirmed the configuration is ready, please continue with the remaining steps.

## Accept the consumer connection request

To accept the consumer connection request, from within [AWS](https://console.aws.amazon.com):

1. Navigate to **Services**, then **Networking & Content Delivery**, then **VPC**.
2. From the menu on the left, under _Virtual private cloud_, click **Endpoint services**.
3. From the _Endpoint services_ table, select the endpoint service you created in [Create endpoint service](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-ec2/llms.txt).
4. At the bottom of the screen, change to the **Endpoint connections** tab.
 1. You should see a row in the _Endpoint connections_ table with a _State_ of _Pending acceptance_.
 2. Select this row, and click the **Actions** button and then **Accept endpoint connection request**.
5. Wait for this to complete, it could take about 30 seconds.

## Request DNS name from Atlan

[Contact Atlan support](https://docs.atlan.com/support/submit-request) to request the regional DNS name of the VPC endpoint that Atlan created in the following format - `vpce-<hash>-<hash.>vpce-svc-<hash>.<region>.vpce.amazonaws.com`. This is the hostname you will need to use to connect to your Microsoft SQL Server on Amazon EC2 instance from within Atlan.

😅 The connection is now established. You can now use the DNS name of the Atlan VPC endpoint as the hostname to [crawl Microsoft SQL Server](https://docs.atlan.com/llms/connectors/microsoft-sql-server/crawl-microsoft-sql-server/llms.txt) in Atlan! 🎉

---