Skip to content

Commit e6269d7

Browse files
zach-carrzach-carr
authored
(DOCPS-13251) AWS PrivateLink (#5)
* (DOCPS-13251) AWS PrivateLink * Create stepfiles * Try 100% diagrams * Restructure privatelink steps * Add ui-org-menu to snooty.toml * To test links * wip * Remove interface endpoint term link * wip * wip * Editing * Editing * Editing * fix bullets * fix bullets
1 parent 0715eed commit e6269d7

16 files changed

+875
-27
lines changed

‎snooty.toml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@ intersphinx = ["https://docs.mongodb.com/manual/objects.inv","https://docs.atlas
66
toc_landing_pages = ["/tutorial/getting-started"]
77

88
[constants]
9+
aws-pl = "AWS PrivateLink"
910

1011
[substitutions]
11-
1212
govcloud = "MongoDB Cloud for Government"
1313
govcloud-short = "MongoDB CloudGov"
1414
2fa = ":abbr:`2FA (Two Factor Authentication)`"
@@ -108,6 +108,7 @@ tls-ssl = ":abbr:`TLS (Transport Layer Security)` :abbr:`SSL (Secure Sockets Lay
108108
tls = ":abbr:`TLS (Transport Layer Security)`"
109109
totp = ":abbr:`TOTP (Time-based One-time Password Algorithm)`"
110110
udp = ":abbr:`UDP (User Datagram Protocol)`"
111+
ui-org-menu = ":icon-mms:`office` :guilabel:`Organizations` menu"
111112
upn = ":abbr:`UPN (User Principal Name)`"
112113
uri = ":abbr:`URI (Uniform Resource Identifier)`"
113114
url = ":abbr:`URL (Uniform Resource Locator)`"

‎source/images/aws-privatelink-directconnect.svg

Lines changed: 3 additions & 0 deletions
Loading

‎source/images/aws-privatelink.svg

Lines changed: 3 additions & 0 deletions
Loading

‎source/includes/facts/auto-scaling-brief.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
|govcloud| clusters support :ref:`Cluster Auto-Scaling
2-
<cluster-autoscaling>`. When auto-scaling is enabled, |service|
2+
<cluster-autoscaling>`. When auto-scaling is enabled, |govcloud-short|
33
automatically scales your cluster tier, storage capacity, or both in
44
response to cluster usage. Consider enabling auto-scaling to allow your
55
cluster to adapt to your current workload and reduce the need to make

‎source/includes/footnotes/data-bearing.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,6 @@
33
For replica sets, the data-bearing servers are the servers hosting
44
the replica set nodes. For sharded clusters, the data-bearing
55
servers are the servers hosting the shards. For sharded clusters,
6-
|service| also deploys servers for the
6+
|govcloud-short| also deploys servers for the
77
:ref:`config servers <sharding-config-server>`; these are charged at
88
a rate separate from the cluster costs.

‎source/includes/privatelink/steps-configure-privatelink-aws.yaml

Lines changed: 210 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,210 @@
1+
title: "Navigate to the :guilabel:`Network Access` page for your project."
2+
ref: project-nav-nw-access-page
3+
level: 4
4+
stepnum: 1
5+
content: |
6+
7+
a. If it is not already displayed, select the organization that
8+
contains your desired project from the |ui-org-menu| in the
9+
navigation bar.
10+
11+
#. If it is not already displayed, select your desired project
12+
from the :guilabel:`Projects` menu in the navigation bar.
13+
14+
#. Click :guilabel:`Network Access` in the sidebar.
15+
16+
---
17+
title: "Create a private endpoint."
18+
ref: create-private-endpoint
19+
level: 4
20+
stepnum: 2
21+
content: |
22+
23+
a. Click the :guilabel:`Private Endpoint` tab.
24+
25+
#. Click :guilabel:`Add Private Endpoint`.
26+
27+
---
28+
title: "Choose a cloud provider."
29+
ref: select-cloud-provider
30+
level: 4
31+
stepnum: 3
32+
content: |
33+
34+
Click the |aws| logo, then click :guilabel:`Next`.
35+
36+
---
37+
title: "Choose a region."
38+
ref: select-region
39+
level: 4
40+
stepnum: 4
41+
content: |
42+
43+
a. From the :guilabel:`Atlas Region` list, select the region
44+
in which you want to create the private endpoint.
45+
46+
#. Click :guilabel:`Next`.
47+
48+
|govcloud-short| creates |vpc| resources in the region
49+
you selected. This might take several minutes to complete.
50+
51+
---
52+
title: "Configure your private endpoint."
53+
ref: configure-private-endpoint-aws
54+
level: 4
55+
stepnum: 5
56+
content: |
57+
58+
a. Enter the following details about your |aws| |vpc|:
59+
60+
.. list-table::
61+
:widths: 20 80
62+
63+
* - :guilabel:`Your VPC ID`
64+
- Unique identifier of the peer |aws| |vpc|. Find this
65+
value on the |vpc| dashboard in your |aws| account.
66+
67+
* - :guilabel:`Your Subnet IDs`
68+
- Unique identifiers of the subnets your |aws| |vpc| uses.
69+
Find these values on the :guilabel:`Subnet` dashboard in
70+
your |aws| account.
71+
72+
.. important::
73+
74+
You must specify at least one subnet. If you don't,
75+
|aws| won't provision an interface endpoint in
76+
your |vpc|. An is required for
77+
clients in your |vpc| to send traffic to the private endpoint.
78+
79+
#. Copy the command the dialog displays and run it using the |aws|
80+
CLI.
81+
82+
.. note::
83+
84+
You can't copy the command until |govcloud-short| finishes
85+
creating |vpc| resources in the background.
86+
87+
See :aws:`Creating an Interface Endpoint </vpc/latest/userguide/vpce-interface.html#create-interface-endpoint>` to perform this task using the |aws| CLI.
88+
89+
#. You might receive an error like the following when you create
90+
the private endpoint:
91+
92+
.. code-block:: sh
93+
:copyable: false
94+
95+
An error occurred (InvalidParameter) when calling the CreateVpcEndpoint
96+
operation: The VPC endpoint service com.amazonaws.vpce.us-east-1.vpce-svc-<...>
97+
does not support the availability zone of the subnet: subnet-<...>.
98+
99+
If you receive this error, |govcloud-short| has deployed |vpc|
100+
resources into different availability zones than the ones to
101+
which you deployed your |vpc| subnets.
102+
Please contact MongoDB Support for assistance resolving this
103+
error. To contact support, click :guilabel:`Support` from the left-hand navigation bar of the |govcloud-short| UI.
104+
105+
#. Click :guilabel:`Next`.
106+
107+
---
108+
title: "Finalize your private endpoint connection."
109+
ref: finalize-private-endpoint
110+
level: 4
111+
stepnum: 6
112+
content: |
113+
114+
a. Enter your :guilabel:`VPC Endpoint ID`. This is a
115+
22-character alphanumeric string that identifies your private
116+
endpoint. Find this value on the |aws| VPC Dashboard under
117+
:guilabel:`Endpoints` > :guilabel:`VPC ID`.
118+
119+
#. Click :guilabel:`Create`.
120+
121+
122+
---
123+
title: "Configure your resources' security groups to send traffic to and receive traffic from the interface endpoint."
124+
level: 4
125+
ref: resource-sg-pl
126+
stepnum: 7
127+
content: |
128+
129+
For each resource that needs to connect to your |govcloud-short|
130+
clusters using {+aws-pl+}, the resource's security group must allow
131+
outbound traffic to the interface endpoint's private IP(s) on all
132+
ports.
133+
134+
See :aws:`Adding Rules to a Security Group </AWSEC2/latest/UserGuide/ec2-security-groups.html#adding-security-group-rule>` in the |aws|
135+
documentation for more information.
136+
137+
---
138+
title: "Create a security group for your interface endpoint to allow resources to access it."
139+
ref: attach-sg-pl
140+
level: 4
141+
stepnum: 8
142+
content: |
143+
144+
This security group must allow inbound traffic on all ports from each
145+
resource that needs to connect to your |govcloud-short| clusters
146+
using {+aws-pl+}:
147+
148+
a. In the |aws| console, navigate to the :guilabel:`VPC Dashboard`.
149+
150+
#. Click :guilabel:`Security Groups`, then click
151+
:guilabel:`Create security group`.
152+
153+
#. Use the wizard to create a security group. Make sure you select
154+
your VPC from the :guilabel:`VPC` list.
155+
156+
#. Select the security group you just created, then click the
157+
:guilabel:`Inbound Rules` tab.
158+
159+
#. Click :guilabel:`Edit Rules`.
160+
161+
#. Add rules to allow all inbound traffic from each resource in your
162+
VPC that you want to connect to your |govcloud-short| cluster.
163+
164+
#. Click :guilabel:`Save Rules`.
165+
166+
#. Click :guilabel:`Endpoints`, then click the endpoint for your
167+
VPC.
168+
169+
#. Click the :guilabel:`Security Groups` tab, then click
170+
:guilabel:`Edit Security Groups`.
171+
172+
#. Add the security group you just created, then click
173+
:guilabel:`Save`.
174+
175+
See :aws:`VPC security groups
176+
</vpc/latest/userguide/VPC_SecurityGroups.html>` in the |aws|
177+
documentation for more information.
178+
179+
---
180+
title: "Verify that the private endpoint is available."
181+
ref: verify-active-pl-aws
182+
level: 4
183+
stepnum: 9
184+
content: |
185+
186+
You can connect to a |govcloud-short| cluster using the {+aws-pl+}
187+
private endpoint when all of the resources are configured and the
188+
private endpoint becomes available.
189+
190+
To verify that the {+aws-pl+} private endpoint is available:
191+
192+
a. In the :guilabel:`Security` section of the left navigation,
193+
click :guilabel:`Network Access`.
194+
#. On the :guilabel:`Private Endpoint` tab, verify the following
195+
statuses for the region that contains the cluster
196+
you want to connect to using {+aws-pl+}:
197+
198+
.. list-table::
199+
:widths: 20 80
200+
201+
* - :guilabel:`Atlas Endpoint Service Status`
202+
- Ready for connection requests
203+
204+
* - :guilabel:`Endpoint Status`
205+
- Available
206+
207+
If you do not see these statuses, see
208+
:ref:`privatelink-troubleshooting` for additional information.
209+
210+
...

‎source/includes/privatelink/steps-connect-to-cluster-privatelink.yaml

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
ref: go-clusters-view-cluster-pl
2+
level: 4
3+
stepnum: 1
4+
title: "Click :guilabel:`Connect`."
5+
content: |
6+
7+
In the :guilabel:`Clusters` view, click :guilabel:`Connect`
8+
for the cluster to which you want to connect.
9+
10+
---
11+
ref: select-private-endpoint-pl
12+
level: 4
13+
stepnum: 2
14+
title: "Select the :guilabel:`Private Endpoint` connection type."
15+
16+
---
17+
ref: select-private-endpoint-connect-pl
18+
level: 4
19+
stepnum: 3
20+
title: "Select the private endpoint to which you want to connect."
21+
22+
---
23+
ref: create-mongodb-user-cluster-pl
24+
level: 4
25+
stepnum: 4
26+
title: "Create a Database User."
27+
content: |
28+
29+
.. important::
30+
31+
**Skip this step** if |govcloud-short| indicates in the
32+
:guilabel:`Setup connection security` step that you have at least
33+
one database user configured in your project. To manage existing
34+
database users, see :ref:`configure-dbusers`.
35+
36+
To access the cluster, you need a MongoDB user with access to the
37+
desired database or databases on the cluster in your project. If your
38+
project has no MongoDB users, |govcloud-short| prompts you to create
39+
a new user with the :ref:`Atlas Admin <atlas-user-privileges>` role.
40+
41+
a. Enter the new user's :guilabel:`Username`.
42+
b. Enter a :guilabel:`Password` for this new user or click
43+
:guilabel:`Autogenerate Secure Password`.
44+
c. Click :guilabel:`Create Database User` to save the user.
45+
46+
Use this user to connect to your cluster in the following step.
47+
48+
Once you have added an IP address to your IP access list and added a
49+
database user, click :guilabel:`Choose Your Connection Method`.
50+
51+
---
52+
ref: connect-details-pl
53+
level: 4
54+
stepnum: 5
55+
title: "Click :guilabel:`Choose a connection method`."
56+
content: |
57+
58+
Private endpoint-aware connection strings are available in one
59+
of the following formats:
60+
61+
- DNS seedlist connection
62+
63+
.. code-block:: none
64+
:copyable: false
65+
66+
mongodb+srv://cluster0-pl-0-auylw.mongodb.net
67+
68+
- Standard connection string
69+
70+
.. code-block:: none
71+
:copyable: false
72+
73+
mongodb://pl-0-us-east-1-auylw.mongodb.net:1024,pl-0-us-east-1-auylw.mongodb.net:1025,pl-0-us-east-1-auylw.mongodb.net:1026/?ssl=true&authSource=admin&replicaSet=Cluster0-shard-0-shard-0
74+
75+
MongoDB recommends that your clients use the DNS seedlist connection
76+
string format. If your driver doesn't support this format, select an
77+
older version of your driver or version :guilabel:`3.4 or earlier` of
78+
the |mongo| shell from the :guilabel:`Connect` tab to use the
79+
standard connection string format.
80+
...

‎source/includes/privatelink/steps-delete-privatelink-aws.yaml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
ref: network-access-pl
2+
level: 4
3+
stepnum: 1
4+
title: "Navigate to the :guilabel:`Network Access` page for your project."
5+
content: |
6+
7+
a. If it is not already displayed, select the organization that
8+
contains your desired project from the |ui-org-menu| in the
9+
navigation bar.
10+
11+
#. If it is not already displayed, select your desired project
12+
from the :guilabel:`Projects` menu in the navigation bar.
13+
14+
#. Click :guilabel:`Network Access` in the sidebar.
15+
---
16+
ref: remove-private-endpoint-aws
17+
level: 4
18+
stepnum: 2
19+
title: "Remove the private endpoint from |govcloud-short|."
20+
content: |
21+
22+
a. Click the :guilabel:`Private Endpoint` tab.
23+
24+
#. Next to the private endpoint you want to remove, click
25+
:guilabel:`Terminate`.
26+
27+
#. To confirm, click :guilabel:`Confirm` in the dialog.
28+
29+
.. note::
30+
31+
When you delete a private endpoint from a region in
32+
|govcloud-short|, you must manually
33+
:aws:`delete the private endpoint </vpc/latest/userguide/delete-vpc-endpoint.html>`
34+
in |aws|. |aws| lists the endpoint as ``rejected``.
35+
|govcloud-short| can't delete this resource because it lacks the
36+
required permissions.
37+
...

‎source/includes/privatelink/steps-enable-regionalized-private-endpoints.yaml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
stepnum: 1
3+
ref: nav-to-project-settings
4+
level: 4
5+
title: "Navigate to the :guilabel:`Settings` page for your project."
6+
content: |
7+
8+
a. If it is not already displayed, select the organization that
9+
contains your desired project from the |ui-org-menu| in the
10+
navigation bar.
11+
12+
#. If it is not already displayed, select your desired project
13+
from the :guilabel:`Projects` menu in the navigation bar.
14+
15+
#. Next to the :guilabel:`Projects` menu, expand the
16+
:guilabel:`Options` menu, then click :guilabel:`Project Settings`.
17+
18+
---
19+
stepnum: 2
20+
ref: enable-regionalized-pl
21+
level: 4
22+
title: "Enable the setting."
23+
content: |
24+
25+
Toggle the :guilabel:`Multiple Regionalized Private Endpoints` setting
26+
to :guilabel:`Yes`.
27+
28+
...

0 commit comments

Comments
 (0)