## Set up a private network link to Microsoft SQL Server on Amazon RDS

URL: https://docs.atlan.com/apps/connectors/database/microsoft-sql-server/how-tos/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-rds

> :::warning Who can do this? You will need your AWS administrator to complete these tasks - you may not have access yourself.

:::warning Who can do this?
 You will need your AWS administrator to complete these tasks - you may not have access yourself.

:::

[AWS PrivateLink](https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-privatelink.html) creates a secure, private connection between services running in AWS. This document describes the steps to set this up between Microsoft SQL Server on Amazon RDS and Atlan.

## Prerequisites

You should already have the following:

- Your own non-default VPC configured in AWS.
- A Microsoft SQL Server on Amazon RDS instance running in AWS, linked to the non-default VPC.
- Private subnets defined within the non-default VPC sufficient for availability.

:::info **Did you know?** 
 You will also need Atlan's AWS account ID later in this process. If you do not already have this, [request it now from Atlan support](https://docs.atlan.com/support/submit-request).

:::

## Set up network to RDS (in AWS)

To set up the private network of your Microsoft SQL Server instance, from within [AWS](https://console.aws.amazon.com):

### Copy network settings

1. Navigate to **Services**, then **Database**, and then **RDS**.
2. On the left, under _Amazon RDS_, click on **Databases**.
3. From the _Databases_ table, click your instance's name under the _DB identifier_ column.
4. Under the _Connectivity & security_ tab, copy the following values:
 1. _Endpoint_ and _Port_ values
 2. _VPC_ value
 3. _Subnet group_ value
5. On the left, click **Subnet groups**.
6. From the table, click the row whose _Name_ matches the subnet group copied above.
7. From the _Subnets_ table, copy each value under the _CIDR block_ column for private subnets.

### Create inbound rule

To create an inbound rule allowing your private subnet access to your RDS instance:

1. On the left, under _Amazon RDS_, click on **Databases**.
2. From the _Databases_ table, click your instance's name under the _DB identifier_ column.
3. Under the _Connectivity & security_ tab, under the _Security_ column and the _VPC security groups_ heading, click the link to your security group.
4. At the bottom of the screen, change to the **Inbound rules** tab and then click the **Edit inbound rules** button.
5. At the bottom of the table, click the **Add rule** button and create the following rule:
 1. For _Type_, use **SQL Server** if you are using the default port (1433), or use **Custom** and enter your port under _Port range_.
 2. For _Source_, use **Custom** and enter your CIDR range (see [Copy network settings](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-rds/llms.txt)).
 3. Repeat these sub-steps for each of your CIDR ranges.
6. Below the table, click the **Save rules** button.

## (Optional) Create RDS proxy

Before you create an RDS proxy, ensure that the user created in the RDS database is enabled with basic authentication. This [method](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy-setup.html#rds-proxy-secrets-arns) uses a username and password to connect to the RDS database.

To create an RDS proxy for your RDS instance:

1. On the left, under _Amazon RDS_, click on **Proxies**.
2. In the upper right of the _Proxies_ table, click the **Create proxy** button.
3. Under _Proxy configuration_, enter the following details:
 1. For _Engine family_, select **SQL Server**.
 2. For _Proxy identifier_, enter a meaningful name for your proxy.
4. Under _Target group configuration_ for _Database_, choose your RDS instance.
5. Under _Authentication_ for the _Secrets Manager secrets_:
 - If you have an existing secret for your RDS instance's database credentials, select it from the dropdown.
 - If not, click the **Create a new secret** link and enter these details in the new tab:
 1. For _Secret type_, select **Credentials for Amazon RDS database**.
 2. For _Credentials_, enter the _Username_ and _Password_ of the database user.
 3. Under _Database_, select your RDS instance.
 4. At the bottom of the form, click the **Next** button.
 5. For _Secret name_, enter a name for the secret.
 6. At the bottom of the form, click the **Next** button.
 7. Leave the automatic secret rotation off and click the **Next** button.
 8. Review the secret definition and click the **Store** button.
 9. Return to the tab where you started creating the RDS proxy.
6. Under _Authentication_ for _IAM authentication_:
 - If IAM authentication is set to **Required**, Atlan will use an IAM role to connect to the RDS proxy.
 - If IAM authentication is set to **Not Allowed**, basic authentication will be enabled. Atlan will use a username and password to connect to the RDS proxy. 
7. Under _Connectivity_, expand the **Additional connectivity configuration**:
 1. For _VPC security group_, select **Choose existing**.
 2. For _Existing VPC security groups_, select the security group you edited with the inbound rules above.
8. At the bottom right of the form, click the **Create proxy** button.
9. From the _Proxies_ table, click the link for the proxy you just created.
10. Under _Proxy endpoints_ section, copy the hostname in the _Endpoint_ column.

## Create internal Network Load Balancer

### Retrieve IP address of the RDS

From an EC2 instance in your AWS account, run the following command:

```
nslookup <endpoint>
```

- Replace `<endpoint>` with the fully-qualified endpoint hostname copied from the RDS endpoint or [RDS proxy](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-rds/llms.txt) created above.

Copy the IP address that comes back from the command, under _Non-authoritative answer_ and to the right of _Address_.

### Start creating NLB

To create an NLB, from within [AWS](https://console.aws.amazon.com):

1. Navigate to **Services**, then **Compute**, and then **EC2**.
2. On the left, under _Load Balancing_, click on **Load Balancers**.
3. At the top of the screen, click the **Create Load Balancer** button.
4. Under the _Network Load Balancer_ option, click the **Create** button.
5. Enter the following _Basic configuration_ settings for the load balancer:
 1. For _Load balancer name_, enter a unique name.
 2. For _Scheme_, select **Internal**.
 3. For _IP address type_, select **IPv4**.
6. Enter the following _Network mapping_ settings for the load balancer:
 1. For _VPC_, select the VPC where the RDS instance is located (see [Copy network settings](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-rds/llms.txt)).
 2. For _Mappings_, select the availability zones with private subnets.
7. Enter the following _Listeners and routing_ settings for the load balancer:
 1. For _Port_, enter **1433** (or the non-default port value from [Copy network settings](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-rds/llms.txt)).
 2. For _Default action_, click the **Create target group** link. This will open the target group creation in a new browser tab.

### Create target group

To create a target group for the NLB:

1. Enter the following _Basic configuration_ settings for the target group:
 1. For _Choose target type_, select **IP addresses**.
 2. For _Target group name_, enter a name.
 3. For _Port_, enter **1433** (or the non-default port value from [Copy network settings](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-rds/llms.txt)).
 4. For _IP address type_, select **IPv4**.
 5. For _VPC_, select the VPC where the RDS instance is located (see [Copy network settings](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-rds/llms.txt)).
 6. At the bottom of the form, click the **Next** button.
2. Enter the following _IP addresses_ settings for the target group:
 1. For _Network_, select the VPC where the RDS instance is located (see [Copy network settings](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-rds/llms.txt)).
 2. For _IPv4 address_, enter the IP address returned by the _nslookup_ command (see [Retrieve IP address of the RDS](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-rds/llms.txt)).
 3. For _Ports_, enter **1433** (or the non-default port value from [Copy network settings](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-rds/llms.txt)).
 4. At the bottom of the _IP addresses_ section, click the **Include as pending below** button.
3. Confirm the following _Review targets_ settings for the target group:
 1. Confirm _IP address_ matches the IP address returned by the _nslookup_ command.
 2. Confirm _Port_ is 1433 (or the non-default port value used by your RDS instance).
4. At the bottom of the form, click the **Create target group** button.

### Finish creating NLB

Return to the browser tab where you started the NLB creation, and continue:

1. Under _Listeners and routing_, click the refresh arrow to the far right of the _Default action_ dropdown box.
2. Select the target group you created above in the _Default action_ drop-down.
3. At the bottom of the form click the **Create load balancer** button.
4. In the resulting screen, click the **View load balancer** button.

### Verify target group is healthy

To verify that the target group is healthy:

1. From the EC2 menu on the left, under _Load Balancing_, click **Target Groups**.
2. From the _Target groups_ table, click the link to the target group you created above.
3. At the bottom of the screen, under the _Details_ tab, check that there is a 1 under both _Total targets_ and _Healthy_.

## Create endpoint service

To create an endpoint service, from within [AWS](https://console.aws.amazon.com):

1. Navigate to **Services**, then **Networking & Content Delivery**, and then **VPC**.
2. From the menu on the left, under _Virtual private cloud_, click **Endpoint services**.
3. At the top of the page, click the **Create endpoint service** button.
4. Enter the following _Endpoint service_ _settings_:
 1. For _Name_, enter a meaningful name.
 2. For _Load balancer type_, choose **Network**.
5. For _Available load balancers_, select the load balancer you created above in [Create internal Network Load Balancer](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-rds/llms.txt).
6. Enter the following _Additional settings_:
 1. For _Require acceptance for endpoint_, enable **Acceptance required**.
 2. For _Supported IP address types_, enable **IPv4**.
7. At the bottom of the form, click the **Create** button.

## Allow Atlan account access

To allow Atlan's account access to the service, from within the endpoint service screen:

1. At the bottom of the screen, change to the **Allow principals** tab.
2. At the top of the _Allow principals_ table, click the **Allow principals** button.
3. Under _Principals to add_ and _ARN_, enter the Atlan account ID and root principal - for example, `arn:aws:iam::<account_id>:root`.
4. At the bottom of the form, click the **Allow principals** button.

## Notify Atlan support

Once all of the above steps are complete, [contact Atlan support](https://docs.atlan.com/support/submit-request). You will need to provide Atlan support:

- The RDS proxy or RDS endpoint DNS - if IAM authentication is enabled on your RDS proxy or RDS database, respectively.

Once this is done, there are additional steps that Atlan then needs to complete:

- Creating a security group.
- Creating an endpoint.

Once the Atlan team has confirmed the configuration is ready, please continue with the remaining steps.

## Accept the consumer connection request

To accept the consumer connection request, from within [AWS](https://console.aws.amazon.com):

1. Navigate to **Services**, then **Networking & Content Delivery**, then **VPC**.
2. From the menu on the left, under _Virtual private cloud_ click **Endpoint services**.
3. From the _Endpoint services_ table, select the endpoint service you created in [Create endpoint service](https://docs.atlan.com/llms/connectors/microsoft-sql-server/set-up-a-private-network-link-to-microsoft-sql-server-on-amazon-rds/llms.txt).
4. At the bottom of the screen, change to the **Endpoint connections** tab.
 1. You should see a row in the _Endpoint connections_ table with a _State_ of _Pending acceptance_.
 2. Select this row, and click the **Actions** button and then **Accept endpoint connection request**.
5. Wait for this to complete, it could take about 30 seconds.

## Request DNS name from Atlan

[Contact Atlan support](https://docs.atlan.com/support/submit-request) to request the regional DNS name of the VPC endpoint that Atlan created in the following format - `vpce-<hash>-<hash.>vpce-svc-<hash>.<region>.vpce.amazonaws.com`. This is the hostname you will need to use to connect to your Microsoft SQL Server on Amazon RDS instance from within Atlan.

😅 The connection is now established. You can now use the DNS name of the Atlan VPC endpoint as the hostname to [crawl Microsoft SQL Server](https://docs.atlan.com/llms/connectors/microsoft-sql-server/crawl-microsoft-sql-server/llms.txt) in Atlan! 🎉

---