Amazon RDS for MariaDB Setup Guide

IMPORTANT: You must have TLS enabled on your database to connect directly to Fivetran. Follow Amazon's TLS setup instructions to enable TLS on your database.

Fivetran connects directly to your Amazon RDS for MariaDB database. This is the simplest method.

If you connect directly, you will create a rule in a security group that allows Fivetran access to your database instance.

Fivetran connects to a separate server in your network that provides an SSH tunnel to your database. You must connect through SSH if your database is in an inaccessible subnet.

If you connect using SSH, you will configure your tunnel server's security group to allow Fivetran access and configure your database's security to allow access from the tunnel.

Before you proceed to the next step, you must follow our SSH connection instructions. If you want Fivetran to tunnel SSH over TLS, follow Amazon's TLS setup instructions to enable TLS on your database.

IMPORTANT: You must have a Business Critical plan to use AWS PrivateLink.

AWS PrivateLink allows VPCs and AWS-hosted or on-premises services to communicate with one another without exposing traffic to the public internet. PrivateLink is the most secure connection method. Learn more in AWS’ PrivateLink documentation.

Follow our AWS PrivateLink setup guide to configure PrivateLink for your database.

Fivetran connects to your database through the Proxy Agent, providing secure communication between Fivetran processes and your database host. The Proxy Agent is installed in your network and creates an outbound network connection to the Fivetran-managed SaaS.

To learn more about the Proxy Agent, how to install it, and how to configure it, see our Proxy Agent documentation.

If you'd like, create a read replica for Fivetran's exclusive use. Using a read replica also allows us to integrate your data without putting unnecessary load on or interrupting the queries running on your primary server. We recommend that you connect a read replica to Fivetran, but it's not required.

If you want to connect Fivetran to your primary database or already have a read replica, skip ahead to Step 3.

1. In your Amazon RDS dashboard, select the MariaDB primary instance that you want to replicate.

   

2. Click Actions, then select Create Read Replica.

   

3. In the Settings section, enter your chosen instance ID.

   

4. In the DB instance size section, specify the instance class for the read replica. It does not need to be as large as your primary instance.

   

5. In the Connectivity section, set the Public access setting to Publicly accessible to ensure that the read replica is accessible from outside your VPC.

   

6. Click Create read replica.

7. The replica's status should now be creating. It will take a few minutes for the read replica to finish being created. The status will change to available when it is done.

   

NOTE: These instructions assume that your database instance is in a VPC. If your database instance is not in a VPC, you can still use these instructions because configuring a non-VPC security group is an almost identical process.

1. In your Amazon RDS dashboard, click on the database that you want to connect to Fivetran.

   

2. In the Endpoint & port column, find the database's port number and make a note of it. You will need the port number to configure Fivetran.

   

3. In the Security column, click the link to the database instance's security group.

   

4. In the Security Group panel, click Actions, then select Edit inbound rules from the drop-down menu.

   

5. Click Add Rule. This creates a new Custom TCP Rule at the bottom of the list with a blank space for a Port Range and a Source IP address.

6. Fill in the new Custom TCP Rule.

   • In the Port Range field, enter your database's port number that you wrote down in Step 2 of this section. The port number will be 3306 for direct connections, unless you changed the default.
   • What you enter in the Custom IP field depends on whether you're connecting directly or using an SSH tunnel.
     • If you're connecting directly, enter Fivetran's IPs for your database's region.
     • If you're connecting using an SSH tunnel, enter {your-ssh-tunnel-server-ip-address}/32.
   • (Optional) Enter a brief description in the Description field.

   

7. Click Save rules.

If your database instance is not in a VPC, skip ahead to Step 4.

1. Return to the RDS Dashboard.

2. Click on your MariaDB database.

   

3. In the Networking column, click the link to the instance's VPC.

   

4. Select the VPC.

   

5. In the Summary tab, click the Network ACL link.

   

6. On the Network ACLs page, click the Network ACL ID.

   

You will see tabs for Inbound Rules and Outbound Rules. You must edit both.

Edit inbound rules

1. Go to the Inbound Rules tab.

   

2. If you have a default VPC that was automatically created by AWS, the settings already allow all incoming traffic. To verify that the settings allow incoming traffic, confirm that the Source value is 0.0.0.0/0 and that the ALLOW entry is listed above the DENY entry.

   

3. If your inbound rules don't include ALL - 0.0.0.0/0 - ALLOW entry, edit the rules to allow the Source to access the port number of your database instance. (The port will be 3306 for direct connections, unless you changed the default.) What you enter in the Source field depends on whether you're connecting directly or using an SSH tunnel.

   • If you're connecting directly, enter Fivetran's IPs for your database's region.
   • If you're connecting using an SSH tunnel, enter {your-ssh-tunnel-server-ip-address}/32.

For additional help, see Amazon's Network ACLs documentation.

Edit outbound rules

1. Go to the Outbound Rules tab.

   

2. If you have a default VPC that was automatically created by AWS, the settings already allow all outbound traffic. To verify that the settings allow outbound traffic, confirm that the Destination value is 0.0.0.0/0 and that the ALLOW entry is listed above the DENY entry.

   

3. If your outbound rules don't include an ALL - 0.0.0.0/0 - ALLOW entry, edit the rules to allow outbound traffic to all ports 1024-65535 for the following Destination(s):

   • If you're connecting directly, enter Fivetran's IPs for your database's region.
   • If you're connecting using an SSH tunnel, enter {your-ssh-tunnel-server-ip-address}/32.

1. Open a connection to your primary database in your favorite SQL tool (for example, MySQL Workbench or the "mysql" command in your operating system's terminal window).

2. Create a user for Fivetran and grant replication permissions by executing the following SQL command. Replace <username> and *E8D46CE25265E545D225A8A6F1BAF642FEBEE5CD with a username and password of your choice.

NOTE: You must grant access to mysql.rds_heartbeat2 to help verify that you are using the correct connector for your database. You must grant access to mysql.rds_configuration to help configure the sync interval.

   CREATE USER <username>@'%' IDENTIFIED VIA mysql_native_password USING '*E8D46CE25265E545D225A8A6F1BAF642FEBEE5CD';
   GRANT SELECT, REPLICATION CLIENT, REPLICATION SLAVE ON *.* TO <username>@'%';
   GRANT SELECT ON mysql.rds_heartbeat2 TO <username>@'%';
   GRANT SELECT ON mysql.rds_configuration TO <username>@'%';
   GRANT EXECUTE ON PROCEDURE mysql.rds_kill to '<username>'@'%'

1. Make sure these commands complete without any errors. If there are errors, you may lack sufficient privileges and should contact your database administrator.

1. Open a connection to your MariaDB primary database using your favorite SQL tool (for example, MySQL Workbench or the mysql command in your operating system's terminal window).

2. Create a Fivetran user and grant SELECT permissions by running the following SQL commands. Replace <username> and *E8D46CE25265E545D225A8A6F1BAF642FEBEE5CD with a username and password of your choice.

   CREATE USER <username>@'%' IDENTIFIED VIA mysql_native_password USING '*E8D46CE25265E545D225A8A6F1BAF642FEBEE5CD';
   GRANT EXECUTE ON PROCEDURE mysql.rds_kill to '<username>'@'%';
   
   -- Option 1: Grant user SELECT permission on all tables and columns
   GRANT SELECT ON *.* TO <username>@'%';
   
   -- Option 2: Grant user SELECT permission on only specified table and columns 
   GRANT SELECT ON <tables/columns> TO <username>@'%';
   

3. Make sure these commands complete without any errors. If there are errors, you may lack sufficient privileges and should contact your database administrator.

Update your database's default RDS configuration to enable binary logging.

Change binary logging format

Turn on automated backups

Fivetran recommends that you set your binlog retention period to seven days (168 hours). To update your binlog retention period, run the following command on the Amazon RDS for MariaDB database that you want to connect to Fivetran:

CALL mysql.rds_set_configuration('binlog retention hours', 168);

Grant Fivetran permission to check binlog retention period