[{"data":1,"prerenderedAt":971},["ShallowReactive",2],{"docs-\u002Fdocs\u002Fnetwork-security\u002Fdatabase-access-configuration":3},{"id":4,"title":5,"body":6,"description":962,"extension":963,"meta":964,"navigation":965,"path":966,"redirect":967,"seo":968,"stem":969,"__hash__":970},"docs\u002Fdocs\u002Fnetwork-security\u002Fdatabase-access-configuration.md","Database Access Configuration",{"type":7,"value":8,"toc":932},"minimark",[9,13,17,22,27,30,55,69,73,76,88,92,96,111,121,139,159,168,191,195,198,233,245,254,258,276,311,318,334,341,371,375,378,392,398,422,426,430,458,462,465,470,473,500,505,535,540,543,566,569,594,599,631,635,662,666,689,693,715,719,728,732,736,763,767,787,791,814,818,822,866,870,908,912,928],[10,11,5],"h1",{"id":12},"database-access-configuration",[14,15,16],"p",{},"DBConvert Streams connects to databases over TCP\u002FIP. This page covers network configuration, user permissions, and managed database setup for each deployment scenario.",[18,19,21],"h2",{"id":20},"deployment-scenarios","Deployment scenarios",[23,24,26],"h3",{"id":25},"local-installation","Local installation",[14,28,29],{},"When DBConvert Streams and your database run on the same machine:",[31,32,33,42,52],"ul",{},[34,35,36,37,41],"li",{},"Use ",[38,39,40],"code",{},"127.0.0.1"," as the hostname in connection settings",[34,43,44,45,48,49],{},"For PostgreSQL, verify ",[38,46,47],{},"pg_hba.conf"," includes an entry for ",[38,50,51],{},"127.0.0.1\u002F32",[34,53,54],{},"For MySQL, default installations typically accept localhost connections",[56,57,59],"alert",{"type":58},"tip",[14,60,61,62,65,66,68],{},"MySQL clients sometimes use UNIX sockets when connecting to ",[38,63,64],{},"localhost",". If you need TCP\u002FIP specifically, use ",[38,67,40],{}," as the hostname in your connection settings.",[23,70,72],{"id":71},"cloud-deployment","Cloud deployment",[14,74,75],{},"When DBConvert Streams runs on a remote server (DigitalOcean, AWS, GCP, etc.):",[77,78,79,82,85],"ol",{},[34,80,81],{},"Identify your server's public IP address",[34,83,84],{},"Add this IP to your database's allowed connections list",[34,86,87],{},"Configure firewall rules to permit traffic on the database port",[56,89],{"type":90,"title":91},"warning","Most cloud database services block external connections by default. Explicit IP whitelisting is required.",[18,93,95],{"id":94},"postgresql-configuration","PostgreSQL configuration",[77,97,98],{},[34,99,100,106,107,110],{},[101,102,103,104],"strong",{},"Edit ",[38,105,47],{}," (typically ",[38,108,109],{},"\u002Fetc\u002Fpostgresql\u002F\u003Cversion>\u002Fmain\u002Fpg_hba.conf","):",[112,113,118],"pre",{"className":114,"code":116,"language":117},[115],"language-text","# Allow specific IP address\nhost    all     all     \u003Cyour-server-ip>\u002F32    scram-sha-256\n\n# For local connections\nhost    all     all     127.0.0.1\u002F32           scram-sha-256\n","text",[38,119,116],{"__ignoreMap":120},"",[77,122,124],{"start":123},2,[34,125,126,132,133,106,136,110],{},[101,127,128,129],{},"Set ",[38,130,131],{},"listen_addresses"," in ",[38,134,135],{},"postgresql.conf",[38,137,138],{},"\u002Fetc\u002Fpostgresql\u002F\u003Cversion>\u002Fmain\u002Fpostgresql.conf",[112,140,144],{"className":141,"code":142,"language":143,"meta":120,"style":120},"language-ini shiki shiki-themes github-light github-dark","# Listen on all interfaces (default is 'localhost' which blocks external connections)\nlisten_addresses = '*'\n","ini",[38,145,146,154],{"__ignoreMap":120},[147,148,151],"span",{"class":149,"line":150},"line",1,[147,152,153],{},"# Listen on all interfaces (default is 'localhost' which blocks external connections)\n",[147,155,156],{"class":149,"line":123},[147,157,158],{},"listen_addresses = '*'\n",[77,160,162],{"start":161},3,[34,163,164,167],{},[101,165,166],{},"Restart PostgreSQL",":",[112,169,173],{"className":170,"code":171,"language":172,"meta":120,"style":120},"language-bash shiki shiki-themes github-light github-dark","sudo systemctl restart postgresql\n","bash",[38,174,175],{"__ignoreMap":120},[147,176,177,181,185,188],{"class":149,"line":150},[147,178,180],{"class":179},"sScJk","sudo",[147,182,184],{"class":183},"sZZnC"," systemctl",[147,186,187],{"class":183}," restart",[147,189,190],{"class":183}," postgresql\n",[23,192,194],{"id":193},"postgresql-cdc-requirements","PostgreSQL CDC requirements",[14,196,197],{},"CDC mode requires additional permissions. The replication user needs:",[112,199,203],{"className":200,"code":201,"language":202,"meta":120,"style":120},"language-sql shiki shiki-themes github-light github-dark","-- Grant replication privilege\nALTER USER your_user REPLICATION;\n\n-- Create a publication for the tables you want to replicate\nCREATE PUBLICATION dbconvert_pub FOR TABLE users, orders;\n","sql",[38,204,205,210,215,221,227],{"__ignoreMap":120},[147,206,207],{"class":149,"line":150},[147,208,209],{},"-- Grant replication privilege\n",[147,211,212],{"class":149,"line":123},[147,213,214],{},"ALTER USER your_user REPLICATION;\n",[147,216,217],{"class":149,"line":161},[147,218,220],{"emptyLinePlaceholder":219},true,"\n",[147,222,224],{"class":149,"line":223},4,[147,225,226],{},"-- Create a publication for the tables you want to replicate\n",[147,228,230],{"class":149,"line":229},5,[147,231,232],{},"CREATE PUBLICATION dbconvert_pub FOR TABLE users, orders;\n",[14,234,235,236,239,240,132,243,167],{},"The ",[38,237,238],{},"wal_level"," must be set to ",[38,241,242],{},"logical",[38,244,135],{},[112,246,248],{"className":141,"code":247,"language":143,"meta":120,"style":120},"wal_level = logical\n",[38,249,250],{"__ignoreMap":120},[147,251,252],{"class":149,"line":150},[147,253,247],{},[18,255,257],{"id":256},"mysql-mariadb-configuration","MySQL \u002F MariaDB configuration",[77,259,260],{},[34,261,262,268,269,272,273,110],{},[101,263,264,265],{},"Configure ",[38,266,267],{},"bind-address"," in the MySQL configuration file (",[38,270,271],{},"\u002Fetc\u002Fmysql\u002Fmy.cnf"," or ",[38,274,275],{},"\u002Fetc\u002Fmysql\u002Fmysql.conf.d\u002Fmysqld.cnf",[112,277,279],{"className":141,"code":278,"language":143,"meta":120,"style":120},"[mysqld]\n# Listen on a specific IP (more secure)\nbind-address = \u003Cyour-server-ip>\n\n# OR allow all interfaces (use only with proper firewall rules)\n# bind-address = 0.0.0.0\n",[38,280,281,286,291,296,300,305],{"__ignoreMap":120},[147,282,283],{"class":149,"line":150},[147,284,285],{},"[mysqld]\n",[147,287,288],{"class":149,"line":123},[147,289,290],{},"# Listen on a specific IP (more secure)\n",[147,292,293],{"class":149,"line":161},[147,294,295],{},"bind-address = \u003Cyour-server-ip>\n",[147,297,298],{"class":149,"line":223},[147,299,220],{"emptyLinePlaceholder":219},[147,301,302],{"class":149,"line":229},[147,303,304],{},"# OR allow all interfaces (use only with proper firewall rules)\n",[147,306,308],{"class":149,"line":307},6,[147,309,310],{},"# bind-address = 0.0.0.0\n",[77,312,313],{"start":123},[34,314,315,167],{},[101,316,317],{},"Restart MySQL",[112,319,321],{"className":170,"code":320,"language":172,"meta":120,"style":120},"sudo systemctl restart mysql\n",[38,322,323],{"__ignoreMap":120},[147,324,325,327,329,331],{"class":149,"line":150},[147,326,180],{"class":179},[147,328,184],{"class":183},[147,330,187],{"class":183},[147,332,333],{"class":183}," mysql\n",[77,335,336],{"start":161},[34,337,338,167],{},[101,339,340],{},"Create a dedicated user and grant privileges",[112,342,344],{"className":200,"code":343,"language":202,"meta":120,"style":120},"-- MySQL 8.0+\nCREATE USER 'dbconvert'@'\u003Cyour-server-ip>' IDENTIFIED BY 'your_password';\nGRANT SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, DROP, INDEX, REFERENCES\n  ON your_database.* TO 'dbconvert'@'\u003Cyour-server-ip>';\nFLUSH PRIVILEGES;\n",[38,345,346,351,356,361,366],{"__ignoreMap":120},[147,347,348],{"class":149,"line":150},[147,349,350],{},"-- MySQL 8.0+\n",[147,352,353],{"class":149,"line":123},[147,354,355],{},"CREATE USER 'dbconvert'@'\u003Cyour-server-ip>' IDENTIFIED BY 'your_password';\n",[147,357,358],{"class":149,"line":161},[147,359,360],{},"GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, DROP, INDEX, REFERENCES\n",[147,362,363],{"class":149,"line":223},[147,364,365],{},"  ON your_database.* TO 'dbconvert'@'\u003Cyour-server-ip>';\n",[147,367,368],{"class":149,"line":229},[147,369,370],{},"FLUSH PRIVILEGES;\n",[23,372,374],{"id":373},"mysql-cdc-requirements","MySQL CDC requirements",[14,376,377],{},"CDC mode requires the binary log enabled and a user with replication privileges:",[112,379,381],{"className":200,"code":380,"language":202,"meta":120,"style":120},"GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'dbconvert'@'\u003Cyour-server-ip>';\nFLUSH PRIVILEGES;\n",[38,382,383,388],{"__ignoreMap":120},[147,384,385],{"class":149,"line":150},[147,386,387],{},"GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'dbconvert'@'\u003Cyour-server-ip>';\n",[147,389,390],{"class":149,"line":123},[147,391,370],{},[14,393,394,395,167],{},"Verify binary logging is enabled in ",[38,396,397],{},"my.cnf",[112,399,401],{"className":141,"code":400,"language":143,"meta":120,"style":120},"[mysqld]\nlog-bin = mysql-bin\nbinlog_format = ROW\nbinlog_row_image = FULL\n",[38,402,403,407,412,417],{"__ignoreMap":120},[147,404,405],{"class":149,"line":150},[147,406,285],{},[147,408,409],{"class":149,"line":123},[147,410,411],{},"log-bin = mysql-bin\n",[147,413,414],{"class":149,"line":161},[147,415,416],{},"binlog_format = ROW\n",[147,418,419],{"class":149,"line":223},[147,420,421],{},"binlog_row_image = FULL\n",[18,423,425],{"id":424},"managed-database-services","Managed database services",[23,427,429],{"id":428},"aws-rds","AWS RDS",[77,431,432,435,441,444,451],{},[34,433,434],{},"Open the RDS console and select your database instance",[34,436,437,438],{},"Click the linked security group under ",[101,439,440],{},"Connectivity & security",[34,442,443],{},"Add an inbound rule allowing TCP traffic on the database port from your DBConvert Streams server IP",[34,445,446,447,450],{},"For CDC on RDS MySQL, enable automated backups and set ",[38,448,449],{},"binlog_format = ROW"," in the parameter group",[34,452,453,454,457],{},"For CDC on RDS PostgreSQL, set ",[38,455,456],{},"rds.logical_replication = 1"," in the parameter group and reboot",[23,459,461],{"id":460},"aws-aurora","AWS Aurora",[14,463,464],{},"Aurora clusters run inside a VPC and require additional networking setup for external access.",[14,466,467],{},[101,468,469],{},"1. VPC networking",[14,471,472],{},"If DBConvert Streams runs outside the Aurora VPC:",[31,474,475,482,493],{},[34,476,477,478,481],{},"Ensure the VPC has an ",[101,479,480],{},"Internet Gateway"," attached",[34,483,484,485,488,489,492],{},"In the ",[101,486,487],{},"Route Table"," for the Aurora subnets, add a route: destination ",[38,490,491],{},"0.0.0.0\u002F0"," → target: your Internet Gateway",[34,494,495,496,499],{},"Verify the Aurora cluster has ",[101,497,498],{},"Public accessibility"," enabled (RDS console → Modify → Connectivity)",[14,501,502],{},[101,503,504],{},"2. Security group",[77,506,507,517,520],{},[34,508,509,510,513,514],{},"Go to ",[101,511,512],{},"EC2 Console"," → ",[101,515,516],{},"Security Groups",[34,518,519],{},"Create or edit the security group attached to your Aurora cluster",[34,521,522,523],{},"Add an inbound rule:\n",[31,524,525,528],{},[34,526,527],{},"Type: MySQL\u002FAurora (3306) or PostgreSQL (5432)",[34,529,530,531,534],{},"Source: your DBConvert Streams server IP (e.g., ",[38,532,533],{},"203.0.113.10\u002F32",")",[14,536,537],{},[101,538,539],{},"3. User setup",[14,541,542],{},"For Aurora MySQL:",[112,544,546],{"className":200,"code":545,"language":202,"meta":120,"style":120},"CREATE USER 'dbconvert'@'%' IDENTIFIED BY 'your_password';\nGRANT SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, DROP, INDEX, REFERENCES\n  ON your_database.* TO 'dbconvert'@'%';\nFLUSH PRIVILEGES;\n",[38,547,548,553,557,562],{"__ignoreMap":120},[147,549,550],{"class":149,"line":150},[147,551,552],{},"CREATE USER 'dbconvert'@'%' IDENTIFIED BY 'your_password';\n",[147,554,555],{"class":149,"line":123},[147,556,360],{},[147,558,559],{"class":149,"line":161},[147,560,561],{},"  ON your_database.* TO 'dbconvert'@'%';\n",[147,563,564],{"class":149,"line":223},[147,565,370],{},[14,567,568],{},"For Aurora PostgreSQL:",[112,570,572],{"className":200,"code":571,"language":202,"meta":120,"style":120},"CREATE USER dbconvert WITH PASSWORD 'your_password';\nGRANT CONNECT ON DATABASE your_database TO dbconvert;\nGRANT USAGE ON SCHEMA public TO dbconvert;\nGRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO dbconvert;\n",[38,573,574,579,584,589],{"__ignoreMap":120},[147,575,576],{"class":149,"line":150},[147,577,578],{},"CREATE USER dbconvert WITH PASSWORD 'your_password';\n",[147,580,581],{"class":149,"line":123},[147,582,583],{},"GRANT CONNECT ON DATABASE your_database TO dbconvert;\n",[147,585,586],{"class":149,"line":161},[147,587,588],{},"GRANT USAGE ON SCHEMA public TO dbconvert;\n",[147,590,591],{"class":149,"line":223},[147,592,593],{},"GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO dbconvert;\n",[14,595,596],{},[101,597,598],{},"4. CDC on Aurora",[31,600,601,616],{},[34,602,603,604,606,607],{},"Aurora MySQL: enable automated backups and set ",[38,605,449],{}," in the cluster parameter group. Grant replication privileges:",[112,608,610],{"className":200,"code":609,"language":202,"meta":120,"style":120},"GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'dbconvert'@'%';\n",[38,611,612],{"__ignoreMap":120},[147,613,614],{"class":149,"line":150},[147,615,609],{},[34,617,618,619,621,622],{},"Aurora PostgreSQL: set ",[38,620,456],{}," in the cluster parameter group and reboot. Grant replication privilege:",[112,623,625],{"className":200,"code":624,"language":202,"meta":120,"style":120},"ALTER USER dbconvert REPLICATION;\n",[38,626,627],{"__ignoreMap":120},[147,628,629],{"class":149,"line":150},[147,630,624],{},[23,632,634],{"id":633},"google-cloud-sql","Google Cloud SQL",[77,636,637,640,652,655],{},[34,638,639],{},"Open Cloud SQL in the GCP console and select your instance",[34,641,509,642,645,646,645,649],{},[101,643,644],{},"Connections"," > ",[101,647,648],{},"Networking",[101,650,651],{},"Authorized networks",[34,653,654],{},"Add your DBConvert Streams server IP",[34,656,657,658,661],{},"For CDC on Cloud SQL PostgreSQL, set ",[38,659,660],{},"cloudsql.logical_decoding = on"," in database flags",[23,663,665],{"id":664},"azure-database","Azure Database",[77,667,668,671,679,682],{},[34,669,670],{},"Open your Azure Database resource",[34,672,509,673,675,676,534],{},[101,674,648],{}," (or ",[101,677,678],{},"Connection security",[34,680,681],{},"Add your DBConvert Streams server IP under firewall rules",[34,683,684,685,688],{},"For CDC on Azure Database for PostgreSQL, set ",[38,686,687],{},"wal_level = logical"," in server parameters",[23,690,692],{"id":691},"digitalocean-managed-databases","DigitalOcean Managed Databases",[77,694,695,702,705],{},[34,696,697,698,701],{},"Go to the ",[101,699,700],{},"Databases"," section in your control panel",[34,703,704],{},"Select your database cluster",[34,706,707,708,645,711,714],{},"Under ",[101,709,710],{},"Settings",[101,712,713],{},"Trusted Sources",", add your DBConvert Streams server IP",[18,716,718],{"id":717},"ssltls-connections","SSL\u002FTLS connections",[14,720,721,722,727],{},"For encrypted connections, configure SSL in the connection spec — see ",[723,724,726],"a",{"href":725},"\u002Fdocs\u002Fnetwork-security\u002Fssl-configuration","SSL Configuration"," for modes and examples.",[18,729,731],{"id":730},"troubleshooting","Troubleshooting",[23,733,735],{"id":734},"connection-refused","Connection refused",[31,737,738,747,750,753],{},[34,739,740,741,743,744,746],{},"Verify the database is listening on the expected address (",[38,742,131],{}," for PostgreSQL, ",[38,745,267],{}," for MySQL)",[34,748,749],{},"Check firewall rules allow traffic on the database port",[34,751,752],{},"Confirm the IP is whitelisted in managed database settings",[34,754,755,756,272,759,762],{},"Try connecting with ",[38,757,758],{},"psql",[38,760,761],{},"mysql"," CLI from the same server to isolate the issue",[23,764,766],{"id":765},"authentication-failures","Authentication failures",[31,768,769,772,778,784],{},[34,770,771],{},"Verify username and password",[34,773,774,775,777],{},"For PostgreSQL, check ",[38,776,47],{}," has the correct authentication method for your IP",[34,779,780,781,534],{},"For MySQL, verify the user is created with the correct host (",[38,782,783],{},"'user'@'host'",[34,785,786],{},"Review database logs for specific error messages",[23,788,790],{"id":789},"cdc-not-working","CDC not working",[31,792,793,803,811],{},[34,794,795,796,798,799,802],{},"PostgreSQL: verify ",[38,797,687],{}," and the user has ",[38,800,801],{},"REPLICATION"," privilege",[34,804,805,806,798,808,802],{},"MySQL: verify ",[38,807,449],{},[38,809,810],{},"REPLICATION SLAVE",[34,812,813],{},"Managed databases: check that the CDC-related parameter group settings are applied and the instance has been rebooted",[18,815,817],{"id":816},"reference","Reference",[23,819,821],{"id":820},"default-ports","Default ports",[823,824,825,838],"table",{},[826,827,828],"thead",{},[829,830,831,835],"tr",{},[832,833,834],"th",{},"Database",[832,836,837],{},"Default Port",[839,840,841,850,858],"tbody",{},[829,842,843,847],{},[844,845,846],"td",{},"MySQL",[844,848,849],{},"3306",[829,851,852,855],{},[844,853,854],{},"PostgreSQL",[844,856,857],{},"5432",[829,859,860,863],{},[844,861,862],{},"Snowflake",[844,864,865],{},"443",[23,867,869],{"id":868},"ip-whitelist-summary","IP whitelist summary",[823,871,872,882],{},[826,873,874],{},[829,875,876,879],{},[832,877,878],{},"Deployment scenario",[832,880,881],{},"IP to whitelist",[839,883,884,892,900],{},[829,885,886,888],{},[844,887,26],{},[844,889,890],{},[38,891,40],{},[829,893,894,897],{},[844,895,896],{},"Cloud server",[844,898,899],{},"Server's public IP address",[829,901,902,905],{},[844,903,904],{},"Behind NAT\u002Fproxy",[844,906,907],{},"NAT\u002Fproxy's public IP address",[18,909,911],{"id":910},"related-docs","Related docs",[31,913,914,921],{},[34,915,916,920],{},[723,917,919],{"href":918},"\u002Fdocs\u002Fapi\u002Fconnections","Connections API Workflows"," — Connection creation, SSL, and SSH tunnel configuration",[34,922,923,927],{},[723,924,926],{"href":925},"\u002Fdocs\u002Fapi\u002Fstreams","Streams API Workflows"," — Stream configuration and CDC mode",[929,930,931],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}",{"title":120,"searchDepth":123,"depth":123,"links":933},[934,938,941,944,951,952,957,961],{"id":20,"depth":123,"text":21,"children":935},[936,937],{"id":25,"depth":161,"text":26},{"id":71,"depth":161,"text":72},{"id":94,"depth":123,"text":95,"children":939},[940],{"id":193,"depth":161,"text":194},{"id":256,"depth":123,"text":257,"children":942},[943],{"id":373,"depth":161,"text":374},{"id":424,"depth":123,"text":425,"children":945},[946,947,948,949,950],{"id":428,"depth":161,"text":429},{"id":460,"depth":161,"text":461},{"id":633,"depth":161,"text":634},{"id":664,"depth":161,"text":665},{"id":691,"depth":161,"text":692},{"id":717,"depth":123,"text":718},{"id":730,"depth":123,"text":731,"children":953},[954,955,956],{"id":734,"depth":161,"text":735},{"id":765,"depth":161,"text":766},{"id":789,"depth":161,"text":790},{"id":816,"depth":123,"text":817,"children":958},[959,960],{"id":820,"depth":161,"text":821},{"id":868,"depth":161,"text":869},{"id":910,"depth":123,"text":911},"Configure database network access, firewall rules, and user permissions for DBConvert Streams.","md",{},false,"\u002Fdocs\u002Fnetwork-security\u002Fdatabase-access-configuration",null,{"title":5,"description":962},"docs\u002Fnetwork-security\u002Fdatabase-access-configuration","gJJOX-3ON791EhqhHcOqP8lt_zPYfuBRB12VNKhHl08",1783896284454]