## Set up a private network link to MySQL

URL: https://docs.atlan.com/apps/connectors/database/mysql/how-tos/set-up-a-private-network-link-to-mysql

> :::warning Who can do this? You need your AWS administrator to complete these tasks - you may not have access yourself.

:::warning Who can do this?
 You need your AWS administrator to complete these tasks - you may not have access yourself.

:::

[AWS PrivateLink](https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-privatelink.html) creates a secure, private connection between services running in AWS. This document describes the steps to set this up between MySQL (RDS) and Atlan.

## Prerequisites

You must already have the following:

- Your own non-default VPC configured in AWS.
- A MySQL RDS instance running in AWS, linked to the non-default VPC.
- Private subnets defined within the non-default VPC sufficient for availability.

:::info **Did you know?** 
 You also need Atlan's AWS account ID later in this process. If you don't already have this, [request it now from support](https://docs.atlan.com/support/submit-request).

:::

## Setup network to RDS (in AWS)

To setup the private network of your MySQL instance, from within [AWS](https://console.aws.amazon.com):

### Copy network settings

1. Navigate to **Services**, then **Database**, then **RDS**.
2. On the left, under _Amazon RDS_, click on **Databases**.
3. From the _Databases_ table, click your instance's name under the _DB identifier_ column.
4. Under the _Connectivity & security_ tab, copy the following values:
 1. _Endpoint_ and _Port_ values
 2. _VPC_ value
 3. _Subnet group_ value
5. On the left, click **Subnet groups**.
6. From the table, click the row whose _Name_ matches the subnet group you copied.
7. From the _Subnets_ table, copy each value under the _CIDR block_ column for private subnets.

### Create inbound rule

To create an inbound rule allowing your private subnet access to your RDS instance:

1. On the left, under _Amazon RDS_, click on **Databases**.
2. From the _Databases_ table, click your instance's name under the _DB identifier_ column.
3. Under the _Connectivity & security_ tab, under the _Security_ column and the _VPC security groups_ heading click the link to your security group.
4. At the bottom of the screen, change to the **Inbound rules** tab and click the **Edit inbound rules** button.
5. At the bottom of the table, click the **Add rule** button and create the following rule:
 1. For _Type_ use **MySQL/Aurora** if you are using the default port (3306), or use **Custom** and enter your port under _Port range_.
 2. For _Source_ use **Custom** and enter your CIDR range (see [Copy network settings](#copy-network-settings)).
 3. Repeat these sub-steps for each of your CIDR ranges.
6. Below the table, click the **Save rules** button.

## Create RDS proxy (optional)

Before you create an RDS proxy, verify that the user created in the RDS database is enabled with basic authentication. This [method](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy-setup.html#rds-proxy-secrets-arns) uses a username and password to connect to the RDS database.

To create an RDS proxy for your RDS instance:

1. On the left, under _Amazon RDS_, click on **Proxies**.
2. In the upper right of the _Proxies_ table, click the **Create proxy** button.
3. Under _Proxy configuration_ enter the following details:
 1. For _Engine family_ select **MySQL**.
 2. For _Proxy identifier_ enter a meaningful name for your proxy.
4. Under _Target group configuration_ for _Database_ choose your RDS instance.
5. Under _Authentication_ for the _Secrets Manager secrets_:
 - If you have an existing secret for your RDS instance's database credentials, select it from the drop-down.
 - If not, click the **Create a new secret** link and enter these details in the new tab:
 1. For _Secret type_ select **Credentials for Amazon RDS database**.
 2. For _Credentials_ enter the _Username_ and _Password_ of the database user.
 3. Under _Database_ select your RDS instance.
 4. At the bottom of the form, click the **Next** button.
 5. For _Secret name_ enter a name for the secret.
 6. At the bottom of the form, click the **Next** button.
 7. Leave the automatic secret rotation off and click the **Next** button.
 8. Review the secret definition and click the **Store** button.
 9. Return to the tab where you started creating the RDS proxy.
6. Under _Authentication_ for _IAM authentication_:
 - If IAM authentication is set to **Required**, Atlan uses an IAM role to connect to the RDS proxy.
 - If IAM authentication is set to **Not Allowed**, basic authentication is enabled. Atlan uses a username and password to connect to the RDS proxy. 
7. Under _Connectivity_ expand the **Additional connectivity configuration**:
 1. For _VPC security group_ select **Choose existing**.
 2. For _Existing VPC security groups_ select the security group you edited with the inbound rules.
8. At the bottom right of the form, click the **Create proxy** button.
9. From the _Proxies_ table, click the link for the proxy you just created.
10. Under _Proxy endpoints_ section, copy the hostname in the _Endpoint_ column.

## Create internal network load balancer

### Retrieve IP address of RDS

From an EC2 instance in your AWS account, run the following command:

```
nslookup <endpoint>
```

- Replace `<endpoint>` with the fully-qualified endpoint hostname you copied from the RDS endpoint or RDS proxy.

Copy the IP address that comes back from the command, under _Non-authoritative answer_ and to the right of _Address_.

### Start network load balancer creation

To create an NLB, from within [AWS](https://console.aws.amazon.com):

1. Navigate to **Services**, then **Compute**, then **EC2**.
2. On the left, under _Load Balancing_, click on **Load Balancers**.
3. At the top of the screen, click the **Create Load Balancer** button.
4. Under the _Network Load Balancer_ option, click the **Create** button.
5. Enter the following _Basic configuration_ settings for the load balancer:
 1. For _Load balancer name_ enter a unique name.
 2. For _Scheme_ select **Internal**.
 3. For _IP address type_ select **IPv4**.
6. Enter the following _Network mapping_ settings for the load balancer:
 1. For _VPC_ select the VPC where the RDS instance is located (see [Copy network settings](#copy-network-settings)).
 2. For _Mappings_ select the availability zones with private subnets.
7. Enter the following _Listeners and routing_ settings for the load balancer:
 1. For _Port_ enter **3306** (or the non-default port value from [Copy network settings](#copy-network-settings)).
 2. For _Default action_ click the **Create target group** link. This opens the target group creation in a new browser tab.

### Create target group

To create a target group for the NLB:

1. Enter the following _Basic configuration_ settings for the target group:
 1. For _Choose target type_ select **IP addresses**.
 2. For _Target group name_ enter a name.
 3. For _Port_ enter **3306** (or the non-default port value from [Copy network settings](#copy-network-settings)).
 4. For _IP address type_ select **IPv4**.
 5. For _VPC_ select the VPC where the RDS instance is located (see [Copy network settings](#copy-network-settings)).
 6. At the bottom of the form, click the **Next** button.
2. Enter the following _IP addresses_ settings for the target group:
 1. For _Network_ select the VPC where the RDS instance is located (see [Copy network settings](#copy-network-settings)).
 2. For _IPv4 address_ enter the IP address returned by the _nslookup_ command (see Retrieve IP address of the RDS).
 3. For _Ports_ enter **3306** (or the non-default port value from [Copy network settings](#copy-network-settings)).
 4. At the bottom of the _IP addresses_ section, click the **Include as pending below** button.
3. Confirm the following _Review targets_ settings for the target group:
 1. Confirm _IP address_ matches the IP address returned by the _nslookup_ command.
 2. Confirm _Port_ is 3306 (or the non-default port value used by your RDS instance).
4. At the bottom of the form, click the **Create target group** button.

### Finish network load balancer creation

Return to the browser tab where you started the NLB creation, and continue:

1. Under _Listeners and routing_, click the refresh arrow to the far right of the _Default action_ drop-down box.
2. Select the target group you created in the _Default action_ drop-down.
3. At the bottom of the form click the **Create load balancer** button.
4. In the resulting screen, click the **View load balancer** button.

### Verify target group is healthy

To verify the target group is healthy:

1. From the EC2 menu on the left, under _Load Balancing_ click **Target Groups**.
2. From the _Target groups_ table, click the link to the target group you created.
3. At the bottom of the screen, under the _Details_ tab, check that there is a 1 under both _Total targets_ and _Healthy_.

## Create endpoint service

To create an endpoint service, from within [AWS](https://console.aws.amazon.com):

1. Navigate to **Services**, then **Networking & Content Delivery**, then **VPC**.
2. From the menu on the left, under _Virtual private cloud_ click **Endpoint services**.
3. At the top of the page, click the **Create endpoint service** button.
4. Enter the following _Endpoint service_ _settings_:
 1. For _Name_ enter a meaningful name.
 2. For _Load balancer type_ choose **Network**.
5. For _Available load balancers_ select the load balancer you created in [Create internal network load balancer](#create-internal-network-load-balancer).
6. Enter the following _Additional settings_:
 1. For _Require acceptance for endpoint_ enable **Acceptance required**.
 2. For _Supported IP address types_ enable **IPv4**.
7. At the bottom of the form, click the **Create** button.

:::info **Did you know?** 
 Under the _Details_ of the endpoint service, enter the DNS name of the Atlan VPC endpoint in the following format - `vpce-<hash>-<hash.>vpce-svc-<hash>.<region>.vpce.amazonaws.com`. This is the hostname you need to use to connect to the RDS instance from within Atlan.

:::

## Grant Atlan account access

To grant Atlan's account access to the service, from within the endpoint service screen:

1. At the bottom of the screen, change to the **Allow principals** tab.
2. At the top of the _Allow principals_ table, click the **Allow principals** button.
3. Under _Principals to add_ and _ARN_ enter the Atlan account ID and specified principal.
4. At the bottom of the form, click the **Allow principals** button.

## Notify Atlan support

Once all these steps are complete, [contact Atlan support](https://docs.atlan.com/support/submit-request).

Provide Atlan support:

- The RDS proxy or RDS endpoint DNS - if IAM authentication is enabled on your RDS proxy or RDS database, respectively.

Once this is done, there are additional steps that Atlan then needs to complete:

- Creating a security group.
- Creating an endpoint.

Once the Atlan team has confirmed the configuration is ready, please continue with the remaining steps.

## Accept consumer connection request

To accept the consumer connection request, from within [AWS](https://console.aws.amazon.com):

1. Navigate to **Services**, then **Networking & Content Delivery**, then **VPC**.
2. From the menu on the left, under _Virtual private cloud_ click **Endpoint services**.
3. From the _Endpoint services_ table, select the endpoint service you created in [Create endpoint service](#create-endpoint-service).
4. At the bottom of the screen, change to the **Endpoint connections** tab.
 1. You can see a row in the _Endpoint connections_ table with a _State_ of _Pending acceptance_.
 2. Select this row, and click the **Actions** button and then **Accept endpoint connection request**.
5. Wait for this to complete, it might take about 30 seconds.

😅 The connection is now established. You can now use the DNS name of the Atlan VPC endpoint as the hostname to [crawl MySQL](https://docs.atlan.com/llms/connectors/mysql/crawl-mysql/llms.txt) in Atlan! 🎉

---