Breadcrumbs

ETL+ Cloud Access to On-premise Resources

Use Case

For customers using ETL+ Cloud with data sources, data warehouses, or ETL+ metadata hosted on premises. ETL+ Cloud requires secure access to the applicable on-premises resources to extract and load data and to manage configuration, scheduling, and metadata.

When connecting to an on-premised ETL+ metadata SQL database, no transactional data is stored in it; it contains only ETL+ configuration and metadata.

Security Within Your On-premise SQL Server Environment

  • Create a dedicated SQL login for ETL+ Cloud.

  • Grant only the permissions required for each resource:

    • Source databases: Typically db_datareader

    • etl_metadata database: db_datareader and db_datawriter

    • Data warehouse: Preferably db_owner; or read, write, and object-management permissions.

  • Enforce encrypted SQL connections using Force Encryption/TLS.

  • Recommended:

    • Replace the default self-signed SQL certificate with a CA-signed certificate.

    • Enable SQL login auditing.

Secure cloud connectivity options

Option 1 — IP-to-IP

Whitelist our static public IP address.

  • ETL+ metadata server (for ETL processes, mandatory): 44.242.38.245

  • ETL+ Web Services (optional for ETL+ Web and MCP+): 44.224.155.65

Advantages: Simple, fast, easy to audit, and lowest maintenance.

Recommended firewall rules:

  • Allow only our static IP.

  • Allow only TCP port 1433 (or your custom SQL port).

  • Do not expose SQL Server publicly to unrestricted Internet traffic.

Option 2 — Reverse Proxy

Use a reverse proxy solution such as FRP or another solution approved by your IT department.

Advantages: Often no firewall changes; works well behind NAT; supports encrypted tunnels.

Option 3 — VPN

Create a VPN between your environment and DataSelf AWS.

Advantages: Highest network isolation; Useful for organizations with strict security policies.

Tradeoffs: More complex deployment; additional operational overhead; may increase SaaS cost.

Network Security

Regardless of the connectivity method:

  • Encrypt all SQL traffic using TLS.

  • Restrict inbound traffic to DataSelf IPs only.

  • Monitor failed login attempts.

  • Enable SQL Server logging.

  • Periodically review firewall rules.