Connect to a cluster from outside its VPC

This page examines different ways to connect to an AlloyDB for PostgreSQL cluster from outside its configured Virtual Private Cloud (VPC). It assumes that you have already created an AlloyDB cluster.

About external connections

Your AlloyDB cluster comprises a number of nodes within a Google Cloud VPC. When you create a cluster, you also configure private services access between one of your VPCs and the Google-managed VPC containing your new cluster. This peered connection lets you use private IP addresses to access resources on the cluster's VPC as if they are part of your own VPC, using private IP addresses.

Situations exist where your application must connect to your cluster from outside this connected VPC:

• Your application runs elsewhere within the Google Cloud ecosystem, outside of the VPC that you connected to your cluster through private services access.

• Your application runs on a VPC that exists outside of Google's network.

• Your application runs "on-premises", on a machine located somewhere else on the public internet.

In all of these cases, you must set up an additional service to enable this kind of external connection to your AlloyDB cluster.

Summary of external-connection solutions

We recommend two general solutions for making external connections, depending upon your needs:

• For project development or prototyping, or for a relatively low-cost production environment, set up an intermediary virtual machine (VM)—also known as a bastion—within your VPC. A variety of methods exist to use this intermediary VM as a secure connection between an external application environment and your AlloyDB cluster.

• For production environments that require high availability, consider establishing a permanent connection between the VPC and your application through either Cloud VPN or Cloud Interconnect.

The next several sections describe these external-connection solutions in detail.

Connect through an intermediary VM

To establish a connection to an AlloyDB cluster from outside its VPC using open-source tools and a minimum of additional resources, run a proxy service on an intermediary VM set up within that VPC. You can set up a new VM for this purpose, or use a VM already running within your AlloyDB cluster's VPC.

As a self-managed solution, using an intermediary VM generally costs less and has a faster set-up time than using a Network Connectivity product. It also has downsides: the connection's availability, security, and data throughput all become dependent on the intermediary VM, which you must maintain as part of your project.

Connect through IAP

Using Identity-Aware Proxy (IAP), you can securely connect to your cluster without the need to expose the intermediary VM's public IP address. You use a combination of firewall rules and Identity and Access Management (IAM) to limit access through this route. This makes IAP a good solution for non-production uses like development and prototyping.

To set up IAP access to your cluster, follow these steps:

1. Install Google Cloud CLI on your external client.

2. Prepare your project for IAP TCP forwarding.

   When defining the new firewall rule, allow ingress TCP traffic to port 22 (SSH). If you are using your project's default network with its pre-populated default-allow-ssh rule enabled, then you don't need to define an additional rule.

3. Set up port forwarding between your external client and the intermediary VM using SSH through IAP.

   gcloud compute ssh my-vm \
          --tunnel-through-iap \
          --zone=ZONE_ID \
          --ssh-flag="-L PORT_NUMBER:ALLOYDB_IP_ADDRESS:5432"

   Replace the following:

   • ZONE_ID: The ID of the zone where the cluster is located—for example, us-central1-a.
   • ALLOYDB_IP_ADDRESS: The IP address of the AlloyDB instance you want to connect to.
   • PORT_NUMBER: The port number of your VM.