AWS VPC peering

You can use AWS VPC peering for C-tier and D-tier Astra Managed Cluster databases hosted on AWS.

Prerequisites

An active Managed Cluster database.
Administrative access or the ability to create VPCs in your AWS account.

Enable the connection in Astra

To enable the VPC peering connection in Astra, you need to attach the connection to your Managed Cluster database, download the internal Secure Connect Bundle (SCB) for use with your VPC peering connection, and add your peering connection to your database’s IP access list.

Astra Portal
DevOps API

In the Astra Portal, click Managed clusters, and then click the name of your Managed Cluster database.
Click Add Peering Connection.
For Account ID, enter your account ID, without dashes, from My Account in the AWS Console.
For VPC ID, enter the VPC ID that you want to use from the list of VPCs in your AWS VPC dashboard.
For VPC CIDR, enter the CIDR block for your AWS VPC. Optionally, you can add the CIDR block to the allowlist.

The CIDR block cannot overlap your Astra VPC CIDR block.
For Application VPC Region, select a receiving VPC region.

To reduce latency, DataStax recommends selecting a region that is geographically close to your database’s region and your AWS VPC region.
Click Initiate.

Use the DevOps API to get VPC peering connection details for a Managed Cluster database:
```
curl -sS -L -X GET "https://api.astra.datastax.com/v2/peering/provider/aws/database/DATABASE_ID" \
--header "Authorization: Bearer APPLICATION_TOKEN" \
--header "Content-Type: application/json"
```
Replace the following:
- DATABASE_ID: The database ID.
- APPLICATION_TOKEN: An application token with the Database Administrator role.
  
  A successful request returns details about the database’s VPC peering connections. If there are none, the response is empty.

Use the DevOps API to create a VPC peering connection for a Managed Cluster database:

curl -sS -L -X POST "https://api.astra.datastax.com/v2/peering/provider/aws/database/DATABASE_ID" \
--header "Authorization: Bearer APPLICATION_TOKEN" \
--header "Content-Type: application/json"
--data '{
  "accountId": AWS_ACCOUNT_ID,
  "vpcId": "VPC_ID",
  "region": "string",
  "cidrBlock": "CIDR_BLOCK"
}'

Replace the following:

DATABASE_ID: The database ID.
APPLICATION_TOKEN: An application token with the Database Administrator role.
AWS_ACCOUNT_ID: The ID of the AWS account that the VPC belongs to.
VPC_ID: The VPC ID that you want to use from the list of VPCs in your AWS VPC dashboard.

CIDR_BLOCK: The CIDR block for your AWS VPC.

Result

A successful request returns an object describing the new VPC peering connection:

{
  "connectionId": "PEERING_CONNECTION_UUID",
  "status": "CONNECTION_STATUS",
  "currentVpc": {
    "provider": "aws",
    "account": "AWS_ACCOUNT_ID",
    "vpcId": "VPC_UUID",
    "cidrBlock": "137.187.23.0/24"
  },
  "otherVpc": {
    "provider": "aws",
    "account": "AWS_ACCOUNT_ID",
    "vpcId": "VPC_UUID",
    "cidrBlock": "137.187.23.0/24"
  }
}

Accepting the peering request in AWS

Do the following in the AWS CLI:

Accept the peering connection:

aws ec2 accept-vpc-peering-connection --vpc-peering-connection-id ASTRA_CONNECTION_ID --region AWS_REGION

For more information, see Accepting a VPC peering connection.

Get the REQUESTER_VPC_CIDR_BLOCK:

aws ec2 describe-vpc-peering-connections --vpc-peering-connection-ids "$PEERING_CONNECTION_ID" --region "$REGION" | jq -r ".VpcPeeringConnections[].RequesterVpcInfo.CidrBlock"

Add the route in your AWS route table with sender’s CIDR and peering connection ID:

aws ec2 create-route --route-table-id AWS_ROUTE_TABLE_ID --destination-cidr-block REQUESTER_VPC_CIDR_BLOCK --vpc-peering-connection-id CONNECTION_ID --region AWS_VPC_REGION

For more information, see Updating your Route tables for a VPC peering connection.

Finalize the configuration

Download the SCB to connect to the Managed Cluster database. This internal SCB ensures the connection is routed through private IP addresses, not the open internet.

You can use the internal SCB in the same way that you use a standard SCB to connect to your database.
If you didn’t do so already, add the VPC connection’s CIDR block to the database IP access list to ensure your application isn’t disconnected.

Remove a VPC peering connection

Use the DevOps API to delete a VPC peering connection for a Managed Cluster database:

curl -sS -L -X DELETE "https://api.astra.datastax.com/v2/peering/provider/aws/database/DATABASE_ID" \
--header "Authorization: Bearer APPLICATION_TOKEN" \
--header "Content-Type: application/json"

If applicable, remove the disconnected peering connection from AWS.

AWS VPC peering

Prerequisites

Create the virtual network

Enable the connection in Astra

Accepting the peering request in AWS

Finalize the configuration

Remove a VPC peering connection

Was this helpful?

Give Feedback