Connecting to a Teradata Managed Cloud From Teradata Database on AWS

Transcription

1 What would you do if you knew? Connecting to a Teradata Managed Cloud From Teradata Database on AWS B K December 2016

2 The product or products described in this book are licensed products of Teradata Corporation or its affiliates. Teradata, Applications-Within, Aster, BYNET, Claraview, DecisionCast, Gridscale, MyCommerce, QueryGrid, SQL-MapReduce, Teradata Decision Experts, "Teradata Labs" logo, Teradata ServiceConnect, Teradata Source Experts, WebAnalyst, and Xkoto are trademarks or registered trademarks of Teradata Corporation or its affiliates in the United States and other countries. Adaptec and SCSISelect are trademarks or registered trademarks of Adaptec, Inc. Amazon Web Services, AWS, [any other AWS Marks used in such materials] are trademarks of Amazon.com, Inc. or its affiliates in the United States and/or other countries. AMD Opteron and Opteron are trademarks of Advanced Micro Devices, Inc. Apache, Apache Avro, Apache Hadoop, Apache Hive, Hadoop, and the yellow elephant logo are either registered trademarks or trademarks of the Apache Software Foundation in the United States and/or other countries. Apple, Mac, and OS X all are registered trademarks of Apple Inc. Axeda is a registered trademark of Axeda Corporation. Axeda Agents, Axeda Applications, Axeda Policy Manager, Axeda Enterprise, Axeda Access, Axeda Software Management, Axeda Service, Axeda ServiceLink, and Firewall-Friendly are trademarks and Maximum Results and Maximum Support are servicemarks of Axeda Corporation. CENTOS is a trademark of Red Hat, Inc., registered in the U.S. and other countries. Cloudera, CDH, [any other Cloudera Marks used in such materials] are trademarks or registered trademarks of Cloudera Inc. in the United States, and in jurisdictions throughout the world. Data Domain, EMC, PowerPath, SRDF, and Symmetrix are registered trademarks of EMC Corporation. GoldenGate is a trademark of Oracle. Hewlett-Packard and HP are registered trademarks of Hewlett-Packard Company. Hortonworks, the Hortonworks logo and other Hortonworks trademarks are trademarks of Hortonworks Inc. in the United States and other countries. Intel, Pentium, and XEON are registered trademarks of Intel Corporation. IBM, CICS, RACF, Tivoli, and z/os are registered trademarks of International Business Machines Corporation. Linux is a registered trademark of Linus Torvalds. LSI is a registered trademark of LSI Corporation. Microsoft, Active Directory, Windows, Windows NT, and Windows Server are registered trademarks of Microsoft Corporation in the United States and other countries. NetVault is a trademark or registered trademark of Dell Inc. in the United States and/or other countries. Novell and SUSE are registered trademarks of Novell, Inc., in the United States and other countries. Oracle, Java, and Solaris are registered trademarks of Oracle and/or its affiliates. QLogic and SANbox are trademarks or registered trademarks of QLogic Corporation. Quantum and the Quantum logo are trademarks of Quantum Corporation, registered in the U.S.A. and other countries. Red Hat is a trademark of Red Hat, Inc., registered in the U.S. and other countries. Used under license. SAP is the trademark or registered trademark of SAP AG in Germany and in several other countries. SAS and SAS/C are trademarks or registered trademarks of SAS Institute Inc. Simba, the Simba logo, SimbaEngine, SimbaEngine C/S, SimbaExpress and SimbaLib are registered trademarks of Simba Technologies Inc. SPARC is a registered trademark of SPARC International, Inc. Symantec, NetBackup, and VERITAS are trademarks or registered trademarks of Symantec Corporation or its affiliates in the United States and other countries. Unicode is a registered trademark of Unicode, Inc. in the United States and other countries. UNIX is a registered trademark of The Open Group in the United States and other countries. Other product and company names mentioned herein may be the trademarks of their respective owners. The information contained in this document is provided on an "as-is" basis, without warranty of any kind, either express or implied, including the implied warranties of merchantability, fitness for a particular purpose, or non-infringement. Some jurisdictions do not allow the exclusion of implied warranties, so the above exclusion may not apply to you. In no event will Teradata Corporation be liable for any indirect, direct, special, incidental, or consequential damages, including lost profits or lost savings, even if expressly advised of the possibility of such damages. The information contained in this document may contain references or cross-references to features, functions, products, or services that are not announced or available in your country. Such references do not imply that Teradata Corporation intends to announce such features, functions, products, or services in your country. Please consult your local Teradata Corporation representative for those features, functions, products, or services available in your country. Information contained in this document may contain technical inaccuracies or typographical errors. Information may be changed or updated without notice. Teradata Corporation may also make improvements or changes in the products or services described in this information at any time without notice. To maintain the quality of our products and services, we would like your comments on the accuracy, clarity, organization, and value of this document. Please teradata-books@lists.teradata.com Any comments or materials (collectively referred to as "Feedback") sent to Teradata Corporation will be deemed non-confidential. Teradata Corporation will have no obligation of any kind with respect to Feedback and will be free to use, reproduce, disclose, exhibit, display, transform, create derivative works of, and distribute the Feedback and derivative works thereof without limitation on a royalty-free basis. Further, Teradata Corporation will be free to use any ideas, concepts, know-how, or techniques contained in such Feedback for any purpose whatsoever, including developing, manufacturing, or marketing products or services incorporating Feedback. Copyright 2016 by Teradata. All Rights Reserved.

3 Table of Contents Preface...5 Purpose... 5 Audience...5 Prerequisites...5 Revision History...6 Additional Information...6 Product Safety Information... 6 Chapter 1: Overview...7 Connection Options... 7 VPN vs. AWS Direct Connect...7 Chapter 2: VPN Connection Setup... 9 VPN Connections... 9 Assumptions... 9 Requirements for VPN Setup... 9 Setting Up the VPN Connection Allocating Elastic IPs Requesting a VPN Creating Security Groups...11 Creating a Virtual Machine Updating the Operating System...11 Installing Openswan and Dependencies...12 Modifying the Network...12 Modifying the Firewall Verifying the IPsec Installation...13 Modifying the IPsec Configuration...14 Validating the VPN Tunnel...16 Connecting to the Database...17 Chapter 3: AWS Direct Connect Setup...19 AWS Direct Connect Setup Assumptions Setting Up the AWS Direct Connect...19 Connecting to a Teradata Managed Cloud From Teradata Database on AWS 3

4 Table of Contents Appendix A: Security Considerations...21 Security Considerations Connecting to a Teradata Managed Cloud From Teradata Database on AWS

5 Preface Purpose This book provides instructions on how to configure your Teradata Managed Cloud (TMC) and Amazon Web Services (AWS) to communicate. The instructions show you how to: Configure systems running in AWS to put data into the TMC Configure a reporting system in AWS to pull information from the TMC Audience This guide is intended for those responsible for setting up communications between the TMC and AWS. Prerequisites You should have access to, or be familiar with, the following: A TMC environment You must be an account administrator on the support portal ( with permission to make changes to the service. An AWS environment You need access to AWS Account Management console with permission to create EC2 instances or provision a Direct Connect. AWS You must have a solid understanding of AWS. Networking You must understand networking terms and concepts. General Linux administration You must know how to configure a Linux system. Time You need time to organize all the activities that occur during the setup of a Direct Connect. It may take as long as 90 days to complete. Connecting to a Teradata Managed Cloud From Teradata Database on AWS 5

6 Preface Revision History Date December 2016 Description Initial release Additional Information Product Safety Information This document may contain information addressing product safety practices related to data or property damage, identified by the word Notice. A notice indicates a situation which, if not avoided, could result in damage to property, such as equipment or data, but not related to personal injury. Example Notice: Improper use of the Reconfiguration utility can result in data loss. 6 Connecting to a Teradata Managed Cloud From Teradata Database on AWS

7 CHAPTER 1 Overview Connection Options Connecting to the TMC must be done through a Virtual Prviate Network (VPN) or a dedicated network connection that ensures only authorized parties have access to your environment. Do not use the VPN connection from the AWS administration console. AWS VPN connection makes every customer appear as though they originate from the same IP, which prevents the TMC from adequately distinguishing between VPNs. VPN vs. AWS Direct Connect There are differences between a VPN and AWS Direct Connect that you must take into consideration when deciding which type of connection to use. Connection Type VPN Direct Connect Speed Cost Considerations The VPN runs over the public internet and must be encrypted and decrypted. Dedicated networking hardware that supports a VPN runs in the 100 Mbps to 1 Gbps range (in reality more toward the slower end). Running a VPN in a virtual machine is slower as the encryption and decryption must be handled by a general purpose CPU. The Direct Connect is a direct, dedicated connection from AWS into the TMC running at a guaranteed speed. The VPN port is included with your TMC environment. The additional cost is for running the virtual machine in AWS EC2 as well as any outbound (relative to AWS) network usage. This can be a few hundred dollars a month. The Direct Connect requires an additional network port from TMC as well as usage costs from AWS for the Direct Connect. Contact your account team for pricing which may also include a one-time setup fee. The VPN can be ready in a week or two. If you need modest connectivity from multiple regions, VPNs are an effective solution. A Direct Connect is useful if you expect to move significant data volumes across the network. There is, however, a 90-day lead time in setting up a Direct Connect. Connecting to a Teradata Managed Cloud From Teradata Database on AWS 7

8 Chapter 1: Overview 8 Connecting to a Teradata Managed Cloud From Teradata Database on AWS

9 CHAPTER 2 VPN Connection Setup VPN Connections A VPN is an encrypted connection over the public internet between a virtual machine in AWS and the TMC firewall. The TMC becomes an extension of your AWS environment with the understanding that communications are routed through an intermediary virtual machine. This is similar to using a corporate VPN on your laptop when traveling. All communications first flow to corporate headquarters and then on to their final destination. Teradata uses the Openswan package on a virtual machine to create or terminate one end of the tunnel in the AWS environment. All communication in AWS communicate with the virtual machine running Openswan; this virtual machine then forwards the communications over the encrypted tunnel to the TMC. There are alternatives to Openswan for creating an IPsec tunnel. If you are familiar with these alternatives you are welcome to use them, but those instructions are not included here. Assumptions You must be familiar with AWS and Linux administration to successfully set up a VPN. This knowledge includes, but is not limited to, the following: AWS security groups Launching an EC2 instance IPTables (Linux firewall) Requirements for VPN Setup Setting up a VPN requires all of the following: Item VPN port Virtual machine Description Each TMC database instance includes one VPN port. If it is unused, you can use it. If it is in use, contact your sales team to order an additional VPN port. You need a virtual machine based on either CentOS or RedHat operating systems. The instructions in this guide uses the AWS Linux AMI. Alter the instructions appropriately if you choose a different Linux system. Connecting to a Teradata Managed Cloud From Teradata Database on AWS 9

10 Chapter 2: VPN Connection Setup Item VPC Keypair Internet access Two public IP addresses Description The VPC where the virtual machines will be deployed. The keypair to log into the virtual machine. The virtual machine must have access to the internet to download and install software. The two public IP addresses should be elastic IPs; the actual values do not matter but they must be allocated in the same region as the virtual machine. Setting Up the VPN Connection 1. Allocate elastic IPs. 2. Request a VPN. 3. Create one or more security groups. 4. Create a virtual machine. 5. Update the operating system. 6. Install Openswan and its dependencies. 7. Modify the network. 8. Modify the firewall. 9. Verify the IPsec installation. 10. Modify the IPsec configuration. 11. Validate the VPN tunnel. 12. Connect to the database. Allocating Elastic IPs 1. Allocate two elastic IPs with the following designations: public IP that will be associated with the virtual machine encryption domain that will uniquely identify your end of the IPsec tunnel Requesting a VPN 1. Complete the VPN request form. If you have an existing TMC environment, create a change request on the Cloud portal at support.teradatacloud.com/. If you are setting up a new TMC environment, your VPN request is included with your on-boarding process. 2. On the request form, provide two public IP addresses. One IP address is the address the TMC sees as the source of VPN traffic. The other IP address is used internally in the TMC to identify you. 10 Connecting to a Teradata Managed Cloud From Teradata Database on AWS

11 Chapter 2: VPN Connection Setup 3. Check the Teradata and Other services boxes. When the form is processed you receive: The password for the IPsec tunnel. An IP subnet that holds your TMC resources. Typically, this is x.y. One or more IP addresses from that subnet for each of your cloud compute units (CCUs). An IP address from that subnet for your Windows-based utility server. An IP address from that subnet for your Linux-based load server. Creating Security Groups The virtual machine needs to accept incoming connections for SSH, HTTP, HTTPS, and port 1025 (which is the Teradata Database). Security groups provide these permissions. You can configure the security group to allow access from the entire internet, a limited range of internet addresses, or just resources within AWS. The virtual machine needs to communicate with the TMC via the IPsec protocol. 1. Create a security group that allows the following communication from the IP address : Inbound UDP on port 500 from /32 Inbound UDP on port 4500 from /32 Inbound protocol 50 from /32 Inbound protocol 51 from /32 Creating a Virtual Machine The virtual machine that terminates the IPsec tunnel performs mostly network transfer and encryption and decryption (CPU) activities. We suggest an M4.large instance to provide sufficient CPU. 1. Place the virtual machine into your VPC. It does not need a public IP automatically assigned as we give it an elastic IP. 2. [Optional] Turn on termination protection. We recommend turning on termination protection. 3. [Optional] Enable CloudWatch monitoring. 4. [Optional] Add a name tag. 5. Apply the security groups you created. 6. Apply an appropriate keypair. 7. Turn off source/destination checking for the instance. 8. Associate the public IP (elastic IP) to the virtual machine. This is the IP you entered as the first IP in the VPN form. Updating the Operating System 1. Launch the virtual machine and log onto it. Connecting to a Teradata Managed Cloud From Teradata Database on AWS 11

12 Chapter 2: VPN Connection Setup 2. Update the operating system: sudo su yum update -y Installing Openswan and Dependencies 1. Perform the following step as root: yum install openswan xl2tpd ppp -y Modifying the Network 1. Run the following commands to enable package forwarding and disable ICMP redirects: echo "net.ipv4.ip_forward = 1" tee -a /etc/sysctl.conf echo "net.ipv4.conf.default.rp_filter = 0" tee -a /etc/sysctl.conf echo "net.ipv4.conf.all.accept_redirects = 0" tee -a /etc/sysctl.conf echo "net.ipv4.conf.all.send_redirects = 0" tee -a /etc/sysctl.conf for vpn in /proc/sys/net/ipv4/conf/*; do echo 0 > $vpn/accept_redirects echo 0 > $vpn/send_redirects echo 0 > $vpn/rp_filter done sysctl -p 2. Add the following lines to the bottom of the /etc/rc.local file to ensure these settings are applied at each reboot: for vpn in /proc/sys/net/ipv4/conf/*; do echo 0 > $vpn/accept_redirects echo 0 > $vpn/send_redirects echo 0 > $vpn/rp_filter done Modifying the Firewall This task assumes that this virtual machine is acting only as a proxy for connections to the TMC. If that is not the case, you may need to modify the rules. 1. Allow only SSH and ICMP traffic into the virtual machine: iptables -I INPUT -p tcp -m state -state NEW -m tcp --dport 22 -j ACCEPT iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -I INPUT -p icmp -j ACCEPT iptables -I INPUT -i lo -j ACCEPT iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited 12 Connecting to a Teradata Managed Cloud From Teradata Database on AWS

13 Chapter 2: VPN Connection Setup 2. Allow outbound IPsec traffic: iptables -A OUTPUT -p ESP -j ACCEPT 3. Forward any traffic for the TMC subnet over the IPsec tunnel (instead of sending it out to the general internet): iptables -t nat -I POSTROUTING -d x.y/28 -j SNAT --to-source encryption_domain_ip The first IP address is the subnet of the TMC resources where x and y are numbers between 2 and 254. The encryption_domain_ip address can be any valid, public IP. Note: It is the second IP used in the VPN form filled out previously. 4. Allow traffic to flow from the TMC back over the IPsec tunnel: iptables -I FORWARD -d x.y/28 -p tcp -m tcp -j ACCEPT iptables -I FORWARD -s x.y/28 -p tcp -m tcp -j ACCEPT 5. Accept inbound connections from AWS (or public, if security groups are setup appropriately) to communicate with resources in the TMC: iptables -t nat -I PREROUTING -i eth0 -p tcp -m tcp --dport j DNAT -- to-destination x.db:1025 iptables -t nat -I PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --todestination x.vw:80 iptables -t nat -I PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j DNAT -- to-destination x.vw:443 The IP address x.db represents one of the CCUs. The IP address x.vw represents the Viewpoint server. Note that both HTTP and HTTPS are allowed on the Viewpoint server. Verifying the IPsec Installation 1. Start the IPsec service: service ipsec start 2. Verify that the service has started: ipsec verify The result should be similar to the following which indicates that the software (Openswan) is functioning as expected: Checking your system to see if IPsec got installed and started correctly: Version check and ipsec on-path Linux Openswan U2.6.37/K amznl.x85_64 (netkey) Checking for IPsec support in kernel SAref kernel support Connecting to a Teradata Managed Cloud From Teradata Database on AWS 13

14 Chapter 2: VPN Connection Setup [N/A] NETKEY: Testing XFRM related proc values Hardware RNG detected, testing if used properly Checking that pluto is running Pluto listening for IKE on udp 500 Pluto listening for NAT-T on udp 4500 Checking for 'ip' command Checking /bin/sh is not /bin/dash Checking for 'iptables' command Opportunistic Encryption Support [DISABLED] Modifying the IPsec Configuration 1. Create or modify the /etc/ipsec.conf file as follows: Note the following representations: a.b.c.d is the internal IP address of the virtual machine. It can be any valid IP address. public_ip is the first public IP seen as the source for traffic from the TMCs point of view. encryption_domain_ip is the second public IP x.y is the subnet with the TMC resources. # /etc/ipsec.conf - Openswan IPsec configuration file # # Manual: ipsec.conf.5 # # Please place your own config files in /etc/ipsed.d/ ending in.conf Version 2.0 # conforms to second version of ipsec.conf specification # basic configuration config setup # Debug-logging controls: "none" for (amlost) none, "all" for lots. # klipsdebug=none # plutodebug="control parsing" protostack = netkey nat_traversal = yes oe = off # Opportunistic encryption # Enable this if you see "failed to find any available worker" # nhelpers=0 conn tmc_vpn_device 14 Connecting to a Teradata Managed Cloud From Teradata Database on AWS

15 Chapter 2: VPN Connection Setup type = tunnel # connection mode forceencaps = no dpddelay = 30 # Dead peer checks dpdtimeout = 120 # Dead peer timeout dpdaction = restart_by_peer # What to do if dead? rekey = yes # Phase 1 (authentication) authby = secret # use CA to provide more secrecy ike = aes256-sha1;modp1024 # Encryptionauthentication;modpgroup ikev2 = no # Force ikev1 ikelifetime = 24h # Equivalent to 86400s aggrmode = no # Disallow aggressive mode # Phase 2 (encryption) phase2 = esp phase2alg = aes256-sha1;modp1024 pfs = yes # Perfect forward secrecy salifetime = 8h # Equivalent to 28,800s-- how long to think that our key pair is secure # Endpoint configuration # Left (is local) left = a.b.c.d # Local IP, behind the NAT leftid = public_ip # Local identification name; this is the public IP leftsourceip = encryption_domain_ip leftsubnet = encryption_domain_ip/32 # Local subnet; this is the secondary public IP # Right (is remote) right = # Remote IP, public rightsubnet = x.y/28 # Remote network range; this is proveded by TD cloud auto = start #You may put your configuration (.conf) file in the "/etc/ipsec.d/" and uncomment this. #include /etc/ipsec.d/*.conf 2. Create an /etc/ipsec.d/ipsec.secrets file and replace the word password with the password you received from Operations after filing the VPN form: <public_ip> : PSK "password" 3. Also in the /etc/ipsec.d/ipsec.secrets file, change the permissions: chmod 600 /etc/ipsec.d/ipsec.secrets Connecting to a Teradata Managed Cloud From Teradata Database on AWS 15

16 Chapter 2: VPN Connection Setup Validating the VPN Tunnel 1. Restart the IPsec service to pick up the updated configuration: chkconfig ipsec on service ipsec restart ipsec auto --status The results should be similar to the following: 000 "tmc_vpn_device": e.f/32=== < >[ m.n,+S=C] < >[+S=C]=== x.y/28; erouted; eroute owner: #2 000 "tmc_vpn_device": myip= q.r; hisip=unset; 000 "tmc_vpn_devide": ike_life: 86400s; ipsec_life: 28800s; rekey margin: 540s: rekey_fuzz: 100%; keyingtries: 0; nat_keepalive: yes 000 "tmc_vpn_device": policy: PSK+ENCRYPT+TUNNEL+PFS+UP+SAREFTRACK+1KOD +rkod; prio: 32,28; interface: eth0; 000 "tmc_vpn_device": dpd: action:restart_by_peer; delay:30; timeout:120; 000 "tmc_vpn_device": newest ISAKMP SA: #1; newest IPsec SA: #2; 000 "tmc_vpn_device": IKE algorithms wanted: AES_CBC(7)_256-SHA1(2)_000- MODP1023(2) 000 "tmc_vpn_device": IKE algorithms foound: AES_CBC(7)_256-SHA1(2)_160- MODP1023(2) 000 "tmc_vpn_device": IKE algorithm newest: AES_CBC_256-SHA1-MODP "tmc_vpn_device": ESP algorithms wanted: AES(12)_256-SHA1(2)_000; pfsgroup=modp1024(2) 000 "tmc_vpn_devide": ESP algorithms loaded: AES(12)_256-SHA1(2)_ "tmc_vpn_device": ESP algorithm newest: AES_256-HMAC_SHA1; pfsgroup=modp #2: "tmc_vpn_device":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 28046s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate 000 #2: "tmc_vpn_device" ref=0 refhim= #1: "tmc_vpn_device":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 85405s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate Check the output for the following messages which tell you that the IPsec tunnel was successfully connected: STATE_MAIN_I4 ISAKMP SA established Output similar to the following indicates there is a configuration error that needs to be resolved with your Teradata Operations team who will trace the IPsec traffic: 000 #8: "tmc_vpn_device":500 STATE_MAIN_I3 (sent MI3, expecting MR3); EVENT_RETRANSMIT in 24s; 16 Connecting to a Teradata Managed Cloud From Teradata Database on AWS

17 Connecting to the Database Chapter 2: VPN Connection Setup 1. Create a connection to the IP address of the virtual machine to automatically forward traffic for the database on port 1025 over the tunnel. Connecting to a Teradata Managed Cloud From Teradata Database on AWS 17

18 Chapter 2: VPN Connection Setup 18 Connecting to a Teradata Managed Cloud From Teradata Database on AWS

19 CHAPTER 3 AWS Direct Connect Setup AWS Direct Connect Setup AWS Direct Connect is a dedicated link between AWS infrastructure and the TMC. Communications flow over this dedicated link rather than the public internet. Using an AWS Direct Connect essentially extends your network to encompass the TMC. The link into AWS is made at any of a number of regionally supported sites listed on the AWS web site ( A cross-connect at the supported site is required to bridge the gap between the TMC and AWS networking equipment. Any one site has a Direct Connect to only a single AWS region. For example, the TMC Switch facility in Las Vegas has a Direct Connect to only the US West (Oregon) AWS region. There is no Direct Connect to any other AWS region. If you need connectivity to another AWS region, you must provision a dedicated line to a support site that has a Direct Connect and then complete the cross-connect within that supported site to AWS infrastructure. Assumptions You are connecting to the US West (Oregon) region. If you are connecting to another region, you must order and install a 1 Gbps or 10 Gbps line to a supported Direct Connect facility within that region. Setting Up the AWS Direct Connect 1. Provision a Direct Connect within the AWS Administration Console ( directconnect/latest/userguide/getstarted.html). Make sure you mention Teradata in the request so that the Switch data facility can match the Teradata request for a cross-connect. 2. Submit a change request on the Cloud portal ( asking for a Direct Connect to AWS. Be prepared to provide IP, subnet, and BGP details from the AWS administration console for the Direct Connect on the form provided. 3. Submit the Letter of Authorization you receive from the AWS to Teradata Cloud Operations as part of the change request you previously submitted. Operations will establish the cross connect in the Switch facility and contact you if further information is needed. 4. When the Direct Connect is established, create a virtual interface into your AWS environment to use the Direct Connect ( getstarted.html#createvirtualinterface). Connecting to a Teradata Managed Cloud From Teradata Database on AWS 19

20 Chapter 3: AWS Direct Connect Setup This interface can support public resources (for example, S3), private resources (for example, VPC), or both. Teradata Operations works with you to complete the virtual interface networking configuration. 20 Connecting to a Teradata Managed Cloud From Teradata Database on AWS

21 APPENDIX A Security Considerations Security Considerations When creating connections between two networks (TMC and AWS in this guide), you are exposing an entry point into both networks. You must take appropriate precautions to ensure your networks, data, and resources remain protected. Specific instructions to secure your environments are beyond the scope of this guide. However, we can offer general guidance. If you set up a VPN, you are running an additional virtual machine with access to your TMC resources over the public internet. While the actual communication (IPsec tunnel) is encrypted, the virtual machine becomes a new target. You can do any of the following to minimize risk: Patch the virtual machine regularly. Use security groups to allow only necessary access to the virtual machine. The instructions in this guide allow only SSH, ICMP, and the IPsec protocol. Run only necessary services on the virtual machine. The instructions in this guide allow only the Openswan service. Use the root account carefully. Set up CloudWatch monitoring to flag unusual activity. Set up syslog capability to capture security events in a separate logging facility. If you use AWS Direct Connect, you are effectively extending your AWS environment to include your TMC resources. The Direct Connect is not accessible outside your AWS environment and should not be an entry point for unauthorized actors. However, you should continue to monitor your network for unusual traffic, just as you did before the Direct Connect was provisioned. Review the resources for security on AWS at Connecting to a Teradata Managed Cloud From Teradata Database on AWS 21

22 Appendix A: Security Considerations 22 Connecting to a Teradata Managed Cloud From Teradata Database on AWS