Use Case
For customers using ETL+ Cloud with data sources, data warehouses, or ETL+ metadata hosted on premises. ETL+ Cloud requires secure access to the applicable on-premises resources to extract and load data and to manage configuration, scheduling, and metadata.
When connecting to an on-premised ETL+ metadata SQL database, no transactional data is stored in it; it contains only ETL+ configuration and metadata.
Security Within Your On-premise SQL Server Environment
-
Create a dedicated SQL login for ETL+ Cloud.
-
Grant only the permissions required for each resource:
-
Source databases: Typically
db_datareader -
etl_metadata database:
db_datareaderanddb_datawriter -
Data warehouse: Preferably
db_owner; or read, write, and object-management permissions.
-
-
Enforce encrypted SQL connections using Force Encryption/TLS.
-
Recommended:
-
Replace the default self-signed SQL certificate with a CA-signed certificate.
-
Enable SQL login auditing.
-
Secure cloud connectivity options
Option 1 — IP-to-IP
Whitelist our static public IP address.
Advantages:
-
Simple
-
Fast
-
Easy to audit
-
Lowest maintenance
Recommended firewall rules:
-
Allow only our static IP.
-
Allow only TCP port 1433 (or your custom SQL port).
-
Do not expose SQL Server publicly to unrestricted Internet traffic.
Option 2 — Reverse Proxy
Use a reverse proxy solution such as FRP or another solution approved by your IT department.
Advantages:
-
Often no firewall changes
-
Works well behind NAT
-
Supports encrypted tunnels
Option 3 — VPN
Create a VPN between your environment and DataSelf AWS.
Advantages:
-
Highest network isolation
-
Useful for organizations with strict security policies
Tradeoffs:
-
More complex deployment
-
Additional operational overhead
-
May increase SaaS cost
Network Security
Regardless of the connectivity method:
-
Encrypt all SQL traffic using TLS.
-
Restrict inbound traffic to DataSelf IPs only.
-
Monitor failed login attempts.
-
Enable SQL Server logging.
-
Periodically review firewall rules.