Configure your environment

A VPC contains the data to process in the serverless runtime environment.

Create a VPC in your AWS account. Enable DNS hostnames and DNS resolution for the VPC.

Also, ensure that at least one of the following scenarios apply to you:

Your VPC's DHCP option is set with AmazonProvidedDNS.

If you have custom DNS servers in your DHCP option set, ensure that AmazonProvidedDNs is part of the option set or that the DNS servers can resolve EC2 internal hostnames. To ensure that the DNS servers can resolve EC2 internal hostnames, internally redirect the DNS query to AmazonProvidedDNS.

A security group controls the traffic flow from the serverless runtime environment.

Create a security group in the VPC. The security group is associated with all ENIs that the serverless runtime environment creates. You specify this security group in the serverless runtime environment properties.

Leave the inbound rules empty to restrict all incoming traffic. The outbound rules can either allow all traffic or limit traffic to all Amazon S3 resources and all source and target systems that the serverless runtime environment accesses.

A private subnet hosts the ENI that the serverless runtime environment uses to connect to your VPC.

Create a private subnet and configure a CIDR range to determine the maximum number of IP addresses and therefore, the scalability, of the serverless runtime environment. Configure the CIDR range to have at least 25 IP addresses per serverless runtime environment so that the serverless runtime environment can scale effectively when developers run concurrent workloads.

After your organization administrator creates a serverless runtime environment in Administrator, the serverless runtime environment creates a ENI in your private subnet.

A public subnet provides internet access through a NAT gateway.

Create a public subnet using any availability zone in the region where you created the VPC. The CIDR range must be within the VPC CIDR range. Choose a range based on the number of IP addresses that you want to have within the subnet.

VPC to VPC connectivity is used to access data in a different VPC than the VPC that connects to the serverless runtime environment. For example, a mapping might read data from an Amazon Redshift cluster in a VPC and write data to a different Amazon Redshift cluster in another VPC.

If you process data across VPCs, configure VPC to VPC connectivity. AWS provides several ways to configure VPC to VPC connectivity, such as VPC peering or AWS Transit Gateway. Use AWS PrivateLink wherever it's applicable. For more information, refer to the AWS documentation.

A NAT gateway allows outbound traffic to the internet from private instances. All compute instances in the serverless runtime environment that are associated with the ENI are private.

Create a NAT gateway to route outbound traffic from the private subnet to the internet. AWS provides several ways to configure subnet routing rules, such as route tables and NACL. For more information, refer to the AWS documentation.

If your organization is configured to allow only trusted IP addresses, you must add the IP addresses of the DMZ NAT gateway to the trusted list. For more information, see

Organization Administration

.

The following table lists the DMZ NAT gateway IP addresses for each POD:

POD	NAT IP addresses to add
NA West 1, NA East 2, US West 3, US East 4, US West 5, US East 6	44.242.20.143 44.239.8.148 54.221.247.69 54.160.9.90 3.131.176.232 18.142.14.24 3.1.147.184 18.220.76.98 13.56.74.27 52.52.220.198
Canada Central 1	3.97.103.68 3.96.182.201
EM West 1 (Ireland)	3.64.66.226 3.125.185.124 54.76.54.130 54.78.183.88 35.176.60.118 18.135.50.152 35.152.49.63 35.152.45.151 15.237.157.126 15.237.97.211 13.49.61.89 13.53.141.231
UK	34.250.251.16 18.170.170.192 13.37.37.71 18.157.124.91 13.53.147.238 15.161.184.93 15.160.41.209
AP Southeast 1 (Australia)	54.253.179.190 3.24.111.61 35.72.149.44 13.112.143.134 3.34.56.248 52.79.244.47 52.76.184.230 18.140.193.120 65.1.80.5 13.234.141.216 18.163.244.73 18.167.71.151
AP Northeast 2 (Japan)	18.181.99.0 13.208.101.21

An IAM role defines a minimal policy that the serverless runtime environment and

advanced cluster

worker nodes use to create, attach, detach, and delete the ENI that's associated with the private subnet in your VPC.

The IAM role must be able to access the S3 location for supplementary files as well as the sources and targets you use in mappings. You can use the following template:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:DetachNetworkInterface",
                "ec2:DeleteTags",
                "ec2:DescribeTags",
                "ec2:CreateTags",
                "ec2:DeleteNetworkInterface",
                "ec2:DescribeSecurityGroups",
                "ec2:CreateNetworkInterface",
                "ec2:DeleteNetworkInterfacePermission",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeAvailabilityZones",
                "ec2:CreateNetworkInterfacePermission",
                "ec2:AttachNetworkInterface",
                "ec2:DescribeNetworkInterfacePermissions",
                "ec2:DescribeSubnets",
                "ec2:DescribeNetworkAcls"
                "ec2:DescribeVpcs"
                "ec2:DescribeRegions"
            ],
            "Resource": "*"
        },
       {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketAcl"
            ],
            "Resource": "arn:aws:s3:::<S3 bucket name>"
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::<Supplementary file location>/*"
            ]
        }
    ]
}

In the trust relationship, specify the Informatica account number as a trusted entity and create an external ID. To find the Informatica account number, create a serverless runtime environment in Administrator and check the environment properties. You can use the following template:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<Informatica account>:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<External ID>"
        }
      }
    }
  ]
}

Table of Contents

Runtime Environments

Runtime Environments