Network and database configuration requirements - Amazon Quick Suite
Network configuration requirementsDatabase configuration requirements for self-administered instances
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Network and database configuration requirements

To serve as data sources, databases need to be configured so that Amazon Quick Suite can access them. Use the following sections to make sure that your database is configured appropriately.

Important

Because a database instance on Amazon EC2 is administered by you rather than Amazon, it must meet both the Network configuration requirements as well as the Database configuration requirements for self-administered instances.

Network configuration requirements

   Intended audience: System administrators 

For you to use your database server from Amazon Quick Suite, your server must be accessible from the internet. It must also allow inbound traffic from Amazon Quick Suite servers.

If the database is on Amazon and in the same Amazon Web Services Region as your Amazon Quick Suite account, you can auto-discover the instance to make connecting to it easier. To do this, you must grant Amazon Quick Suite permissions to access it. For more information, see Accessing data sources.

Network configuration for an Amazon instance in a default VPC

In some cases, your database might be on an Amazon cluster or instance that you created in a default VPC. Thus, it's publicly accessible (that is, you didn't choose to make it private). In such cases, your database is already appropriately configured to be accessible from the internet. However, you still need to enable access from Amazon Quick Suite servers to your Amazon cluster or instance. For further details on how to do this, choose the appropriate topic following:

Network configuration for an Amazon instance in a nondefault VPC

If you are configuring an Amazon instance in a nondefault VPC, make sure that the instance is publicly accessible and that the VPC has the following:

  • An internet gateway.

  • A public subnet.

  • A route in the route table between the internet gateway and the Amazon instance.

  • Network access control lists (ACLs) in your VPC that allow traffic between the cluster or instance and Amazon Quick Suite servers. These ACLs must do the following:

    • Allow inbound traffic from the appropriate Amazon Quick Suite IP address range and all ports to the IP address and port that the database is listening on.

    • Allow outbound traffic from the database’s IP address and port to the appropriate Amazon Quick Suite IP address range and all ports.

    For more information about Amazon Quick Suite IP address ranges, see IP address ranges for Amazon Quick Suite following.

    For more information about configuring VPC ACLs, see Network ACLs.

  • Security group rules that allow traffic between the cluster or instance and Amazon Quick Suite servers. For further details on how to create appropriate security group rules, see Authorizing connections to Amazon data sources.

For more information about configuring a VPC in the Amazon VPC service, see Networking in Your VPC.

Network configuration for an Amazon instance in a private VPC

If your database is on an Amazon cluster or instance that you created in a private VPC, you can use it with Amazon Quick Suite. For more information, see Connecting to a Amazon VPC with Amazon Quick Suite.

For more information on Amazon VPC, see Amazon VPC and Amazon VPC Documentation.

Network configuration for an Amazon instance that is not in a VPC

If you are configuring an Amazon instance that is not in a VPC, make sure that the instance is publicly accessible. Also, make sure that there is a security group rule that allows traffic between the cluster or instance and Amazon Quick Suite servers. For further details on how to do this, choose the appropriate topic following:

Network configuration for a database instance other than Amazon

To use SSL to secure your connections to your database (recommended), make sure that you have a certificate signed by a recognized certificate authority (CA). Amazon Quick Suite doesn't accept certificates that are self-signed or issued from a nonpublic CA. For more information, see Amazon Quick Suite SSL and CA certificates.

If your database is on a server other than Amazon, you must change that server's firewall configuration to accept traffic from the appropriate Amazon Quick Suite IP address range. For more information about Amazon Quick Suite IP address ranges, see IP address ranges for Amazon Quick Suite. For any other steps that you need to take to enable internet connectivity, see your operating system documentation.

Amazon Quick Suite SSL and CA certificates

Following is a list of accepted public certificate authorities. If you are using a database instance other than Amazon, your certificate must be on this list, or it won't work.

  • AAA Certificate Services

  • AddTrust Class 1 CA Root

  • AddTrust External CA Root

  • AddTrust Qualified CA Root

  • AffirmTrust Commercial

  • AffirmTrust Networking

  • AffirmTrust Premium

  • AffirmTrust Premium ECC

  • America Online Root Certification Authority 1

  • America Online Root Certification Authority 2

  • Baltimore CyberTrust Code Signing Root

  • Baltimore CyberTrust Root

  • Buypass Class 2 Root CA

  • Buypass Class 3 Root CA

  • Certum CA

  • Certum Trusted Network CA

  • Chambers of Commerce Root

  • Chambers of Commerce Root - 2008

  • Class 2 Primary CA

  • Class 3P Primary CA

  • Deutsche Telekom Root CA 2

  • DigiCert Assured ID Root CA

  • DigiCert Global Root CA

  • DigiCert High Assurance EV Root CA

  • Entrust.net Certification Authority (2048)

  • Entrust Root Certification Authority

  • Entrust Root Certification Authority - G2

  • Equifax Secure eBusiness CA-1

  • Equifax Secure Global eBusiness CA-1

  • GeoTrust Global CA

  • GeoTrust Primary Certification Authority

  • GeoTrust Primary Certification Authority - G2

  • GeoTrust Primary Certification Authority - G3

  • GeoTrust Universal CA

  • Global Chambersign Root - 2008

  • GlobalSign

  • GlobalSign Root CA

  • Go Daddy Root Certificate Authority - G2

  • GTE CyberTrust Global Root

  • KEYNECTIS ROOT CA

  • QuoVadis Root CA 2

  • QuoVadis Root CA 3

  • QuoVadis Root Certification Authority

  • SecureTrust CA

  • Sonera Class1 CA

  • Sonera Class2 CA

  • Starfield Root Certificate Authority - G2

  • Starfield Services Root Certificate Authority - G2

  • SwissSign Gold CA - G2

  • SwissSign Platinum CA - G2

  • SwissSign Silver CA - G2

  • TC TrustCenter Class 2 CA II

  • TC TrustCenter Class 4 CA II

  • TC TrustCenter Universal CA I

  • Thawte Personal Freemail CA

  • Thawte Premium Server CA

  • thawte Primary Root CA

  • thawte Primary Root CA - G2

  • thawte Primary Root CA - G3

  • Thawte Server CA

  • Thawte Timestamping CA

  • T-TeleSec GlobalRoot Class 2

  • T-TeleSec GlobalRoot Class 3

  • UTN - DATACorp SGC

  • UTN-USERFirst-Client Authentication and Email

  • UTN-USERFirst-Hardware

  • UTN-USERFirst-Object

  • Valicert

  • VeriSign Class 1 Public Primary Certification Authority - G3

  • VeriSign Class 2 Public Primary Certification Authority - G3

  • VeriSign Class 3 Public Primary Certification Authority - G3

  • VeriSign Class 3 Public Primary Certification Authority - G4

  • VeriSign Class 3 Public Primary Certification Authority - G5

  • VeriSign Universal Root Certification Authority

  • XRamp Global Certification Authority

IP address ranges for Amazon Quick Suite

For more information on the IP address ranges for Amazon Quick Suite in supported Regions, see Amazon Regions, websites, IP address ranges, and endpoints.

Database configuration requirements for self-administered instances

   Intended audience: System administrators and Amazon Quick Suite administrators 

For a database to be accessible to Amazon Quick Suite, it must meet the following criteria:

  • It must be accessible from the internet. To enable internet connectivity, see your database management system documentation.

  • It must be configured to accept connections and authenticate access using the user credentials that you provide as part of creating the data set.

  • If you are connecting to MySQL or PostgreSQL, the database engine must be accessible from your host or IP range. This optional security limitation is specified in MySQL or PostgreSQL connection settings. If this limitation is in place, any attempt to connect from a nonspecified host or IP address is rejected, even if you have the correct username and password.

  • In MySQL, the server accepts the connection only if the user and host are verified in the user table. For more information, see Access Control, Stage 1: Connection Verification in the MySQL documentation.

  • In PostgreSQL, you control client authentication by using the pg_hba.conf file in the database cluster's data directory. However, this file might be named and located differently on your system. For more information, see Client Authentication in the PostgreSQL documentation.