Runtime Environments

Back Next

Create and configure your environment manually

Create and configure AWS resources in your VPC to connect to the serverless runtime environment in Informatica's VPC.

The following image shows the resources in a sample environment:

The serverless runtime environment in Informatica’s AWS account connects to the components you create in your AWS account to run mappings. Informatica’s AWS account contains a VPC with the serverless runtime environment. The VPC in Informatica’s AWS account points to a private subnet in the VPC in your AWS account through an ENI. The private subnet in your AWS account points to a public subnet that is associated with a NAT gateway. The VPC in your AWS account also contains an internet gateway and an IAM role, and it can connect to another VPC in the same account.

Use the following guidelines to create and configure each resource:

VPC: A VPC contains the data to process in the serverless runtime environment.

Create a VPC in your AWS account. Enable DNS hostnames and DNS resolution for the VPC.

Also, ensure that at least one of the following scenarios apply to you:
Your VPC's DHCP option is set with AmazonProvidedDNS.
If you have custom DNS servers in your DHCP option set, ensure that AmazonProvidedDNs is part of the option set or that the DNS servers can resolve EC2 internal hostnames. To ensure that the DNS servers can resolve EC2 internal hostnames, internally redirect the DNS query to AmazonProvidedDNS.
Security group: A security group controls the traffic flow from the serverless runtime environment.

Create a security group in the VPC. The security group is associated with all ENIs that the serverless runtime environment creates. You specify this security group in the serverless runtime environment properties.

Leave the inbound rules empty to restrict all incoming traffic. The outbound rules can either allow all traffic or limit traffic to all Amazon S3 resources and all source and target systems that the serverless runtime environment accesses.
Private subnet to host the ENI: A private subnet hosts the ENI that the serverless runtime environment uses to connect to your VPC.

Create a private subnet and configure a CIDR range to determine the maximum number of IP addresses and therefore, the scalability, of the serverless runtime environment. Configure the CIDR range to have at least 25 IP addresses per serverless runtime environment so that the serverless runtime environment can scale effectively when developers run concurrent workloads.
After your organization administrator creates a serverless runtime environment in Administrator, the serverless runtime environment creates a ENI in your private subnet.
Public subnet for internet access: A public subnet provides internet access through a NAT gateway.

Create a public subnet using any availability zone in the region where you created the VPC. The CIDR range must be within the VPC CIDR range. Choose a range based on the number of IP addresses that you want to have within the subnet.
VPC to VPC connectivity: VPC to VPC connectivity is used to access data in a different VPC than the VPC that connects to the serverless runtime environment. For example, a mapping might read data from an Amazon Redshift cluster in a VPC and write data to a different Amazon Redshift cluster in another VPC.

If you process data across VPCs, configure VPC to VPC connectivity. AWS provides several ways to configure VPC to VPC connectivity, such as VPC peering or AWS Transit Gateway. Use AWS PrivateLink wherever it's applicable. For more information, refer to the AWS documentation.
NAT gateway for internet access from the private subnet: A NAT gateway allows outbound traffic to the internet from private instances. All compute instances in the serverless runtime environment that are associated with the ENI are private.

Create a NAT gateway to route outbound traffic from the private subnet to the internet. AWS provides several ways to configure subnet routing rules, such as route tables and NACL. For more information, refer to the AWS documentation.
IAM role: An IAM role defines a minimal policy that the serverless runtime environment and
advanced cluster
worker nodes use to create, attach, detach, and delete the ENI that's associated with the private subnet in your VPC.

The IAM role must be able to access the S3 location for supplementary files as well as the sources and targets you use in mappings. You can use the following template:

{ "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "ec2:DetachNetworkInterface", "ec2:DeleteTags", "ec2:DescribeTags", "ec2:CreateTags", "ec2:DeleteNetworkInterface", "ec2:DescribeSecurityGroups", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAvailabilityZones", "ec2:CreateNetworkInterfacePermission", "ec2:AttachNetworkInterface", "ec2:DescribeNetworkInterfacePermissions", "ec2:DescribeSubnets", "ec2:DescribeNetworkAcls" ], "Resource": "*" }, { "Sid": "VisualEditor1", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketAcl" ], "Resource": "arn:aws:s3:::<S3 bucket name>" }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::<Supplementary file location>/*" ] } ] }

In the trust relationship, specify the Informatica account number as a trusted entity and create an external ID. To find the Informatica account number, create a serverless runtime environment in Administrator and check the environment properties. You can use the following template:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::<Informatica account>:root" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "<External ID>" } } } ] }

Rename Saved Search

Table of Contents

Runtime Environments

Runtime Environments

Create and configure your environment manually

Create and configure your environment manually