Connect using AWS VPC peering

This topic describes how to create an AWS VPC peering connection and a tenant peering connection address in OceanBase Cloud, and use the address to connect to a database. The example uses an Oracle-mode tenant in an AWS international region.

Prerequisites

• You have registered an OceanBase Cloud account and created a cluster instance and a tenant. For more information, see Create an instance and Create a tenant. Peering connection addresses must be available in the instance region, with the corresponding creation option displayed in the console.
• You have an AWS account with permissions to view the target VPC, accept peering connection requests, and configure route tables.
• You have selected or created the VPC that hosts your application in AWS. The application VPC must be in the same region as the OceanBase Cloud instance.
• You have obtained the AWS account ID, VPC ID, and IPv4 CIDR of the application VPC, and identified the application subnets and their associated route tables.
• The IPv4 CIDR blocks of the application VPC and the local OceanBase VPC provided in the OceanBase Cloud console do not overlap. If either VPC has multiple IPv4 CIDR blocks, check all of them. For more information, see VPC peering limitations.
• You have added the client IP addresses or required CIDR blocks to the tenant allowlist. Application-side security groups, network ACLs, and other network policies must allow access to the target database address and port. For more information, see Configure an IP address allowlist.

Set up a peering connection for the first time

If no peering connection is available in the current project, create one first. Then follow the steps in Use an existing peering connection to create a tenant access address.

Step 1: Create a peering connection in OceanBase Cloud

1. Log in to the OceanBase Cloud console, switch to the project that contains the target instance, and click Networking in the left-side navigation pane.

2. On the Networking page, click Create peering connection.

3. In the dialog box, complete Step 1: Configure peering connection as described below, and click Create.

   Configuration item	Description
   1. Select cloud provider	Select AWS.
   OceanBase VPC	Select the region of the target OceanBase Cloud instance and use the local VPC information provided on the page. Record its IPv4 CIDR block for application-side routing.
   Peer application VPC	Configure the following parameters in the Peer application VPC section: AWS account ID: Enter the 12-digit ID of the AWS account that owns the application VPC. You can find it in the account menu in the upper-right corner of the AWS Management Console. Peer VPC ID: Enter the application VPC ID, available on the Your VPCs page in the Amazon VPC console. Peer CIDR: Enter the IPv4 CIDR block of the application VPC, such as 10.20.0.0/16. It must not overlap with the local OceanBase VPC CIDR block.

4. Wait for the peering connection request to be created. Record the local OceanBase VPC ID and the peer application VPC ID.

Step 2: Accept the peering connection request in AWS

1. Log in to the Amazon VPC console with the AWS account that owns the application VPC, and select the region of that VPC.

2. In the left-side navigation pane, choose Peering connections.

3. Find the request in the Pending acceptance state. Verify that the requester VPC is the local OceanBase VPC and the accepter VPC is your application VPC. Record the AWS peering connection ID, which starts with pcx-.

4. Select the connection, choose Actions > Accept request, and confirm acceptance.

5. Refresh the connection list and verify that the connection is Active.

   For detailed instructions, see Accept or reject a VPC peering connection.

Step 3: Configure application-side routes and complete setup

1. In the OceanBase Cloud peering connection wizard, copy the IPv4 CIDR block of the local OceanBase VPC.

2. Return to the Amazon VPC console, choose Route tables, and find the route table used by the application subnet.

3. Choose Routes > Edit routes > Add route, enter the following information, and save the route.

   Parameter	Description
   Destination	Enter the local OceanBase VPC CIDR block copied from the OceanBase Cloud console.
   Target	Select Peering connection, and select the AWS peering connection ID (pcx-…) recorded in Step 2.

4. Verify that the route is active and is not in the Blackhole state. If the application spans multiple subnets, check the route table used by each subnet and add the required routes.

5. Return to the OceanBase Cloud console. In Step 3: Accept connection and add route, click Done.

Use an existing peering connection

If a peering connection is already available, you can reuse it to create a tenant access address. The connection must belong to the same project as the target instance and use the same cloud provider and region. Its peer VPC must be the application VPC.

1. Log in to the OceanBase Cloud console. On the Instances page, expand the target instance and choose Connect > Get connection string for the target tenant.

2. In the dialog box, select VPC peering.

3. Under Step 1: Configure peering connection address, select the peering connection ID to use for database access and click Create peering connection address.

4. Wait for address creation to complete and verify that an available peering connection address and port are displayed.

5. Under Step 2: Access database, select an existing database and account, or create them as needed.

   Note

   If you create an account, securely store the generated password.

6. Select a connection method, such as OBClient, and copy the connection command generated by the console. Run it from a client in the application VPC. Once connected, you can use the database.

Follow-up operations

View addresses and use other address types

After creating the address, you can view it in the Deployment diagram on the tenant workspace page.

VPC peering supports primary, read-only, and read/write splitting addresses. Obtain the connection string for each address type according to your application requirements.

Peering connection addresses can coexist with existing PrivateLink addresses. Select the appropriate address for the network where your application runs.

Change the application VPC or delete an address

If you need to reconfigure an address, for example, after changing the application VPC, perform the following steps:

1. On the Instances page in the OceanBase Cloud console, click the target tenant name to open the tenant workspace.

2. In the Deployment diagram on the tenant workspace page, click the delete button to delete the peering connection address.

3. After the address is deleted, follow the procedure in this topic to select or create a peering connection to the new application VPC. Recreate the tenant address and verify connectivity.

Troubleshoot connection issues