Use Case
For clients hosting their own ETL+ metadata and wanting to leverage ETL+ Web cloud services. This requires a secure access from ETL+ Web cloud services to your etl_metadata SQL database to store and retrieve configuration, scheduling, and metadata information. No transactional data is stored in this database. It contains only ETL+ metadata.
Security inside your SQL instance
-
Create a dedicated SQL login for ETL+ Web.
-
Grant only the db_datareader and db_datawriter roles on the etl_metadata database.
-
Enforce encrypted SQL connections (Force Encryption / TLS).
-
Recommended:
-
Replace the default self-signed SQL certificate with a CA-signed certificate.
-
Rotate the SQL login password periodically.
-
Enable SQL login auditing.
-
Secure cloud connectivity options
Option 1 — IP-to-IP
Whitelist our static public IP address.
Advantages:
-
Simple
-
Fast
-
Easy to audit
-
Lowest maintenance
Recommended firewall rules:
-
Allow only our static IP.
-
Allow only TCP port 1433 (or your custom SQL port).
-
Do not expose SQL Server publicly to unrestricted Internet traffic.
Option 2 — Reverse Proxy
Use a reverse proxy solution such as FRP or another solution approved by your IT department.
Advantages:
-
Often no firewall changes
-
Works well behind NAT
-
Supports encrypted tunnels
Option 3 — VPN
Create a VPN between your environment and DataSelf AWS.
Advantages:
-
Highest network isolation
-
Useful for organizations with strict security policies
Tradeoffs:
-
More complex deployment
-
Additional operational overhead
-
May increase SaaS cost
Network Security
Regardless of the connectivity method:
-
Encrypt all SQL traffic using TLS.
-
Restrict inbound traffic to DataSelf IPs only.
-
Monitor failed login attempts.
-
Enable SQL Server logging.
-
Periodically review firewall rules.
Frequently Asked Questions
Does DataSelf require sysadmin? No. Only db_datareader and db_datawriter permissions on the etl_metadata database are required.
Can we use Windows Authentication? Yes, if network connectivity supports Active Directory/Kerberos authentication. SQL Authentication is typically simpler for cloud-to-on-premises deployments.
Can we use a non-default SQL port? Yes. ETL+ Web can connect using any SQL Server TCP port.
Is the metadata database sensitive? The etl_metadata database contains ETL+ configuration and metadata but does not contain source system’s transactional data. Even so, it should be protected using the same security best practices applied to any production SQL database.