Solution 5: Network connectivity for an on-premises data source

This solution is recommended if your data source meets the following condition.

• The data source is deployed in an on-premises data center.

Step 1: Obtain basic information

Step 2: Establish network connectivity

You can use a dedicated physical connection to connect your on-premises data center to Alibaba Cloud. This establishes network connectivity between the VPC and your on-premises data center.

Step 3: Add a resource group route

To allow DataWorks to access the on-premises data source, you must add a custom route in the DataWorks resource group for the CIDR block of your on-premises data center.

1. Go to the Resource Groups page in the DataWorks console. Find the target resource group and click Operation in the Network Settings column.

2. In the relevant feature module section, find the bound VPC and click Operation in the Custom Route column.

3. Click Add Route. Set CIDR Block to Destination CIDR Block and set Destination CIDR Block to the CIDR block of your on-premises data center.

Step 4: (Optional) Configure an IP allowlist

If your data source uses an IP allowlist for access control, you must add the vSwitch CIDR block bound to the resource group to the IP allowlist.

This topic uses MySQL as an example to show how to configure an IP allowlist that grants a user access to the database only from the resource group's vSwitch CIDR block.

1. Log on to the database as an administrator.

2. Create a user account for DataWorks to access the data source and grant the required permissions.

   -- The username is "dataworks_user". You can customize it.
   -- The password is "StrongPassword123!". You can customize it.
   CREATE USER 'dataworks_user'@'<vswitch-cidr-block>' IDENTIFIED BY 'StrongPassword123!';
   -- Grant the user permissions to access a specific database, such as mydatabase, from the vSwitch CIDR block.
   GRANT ALL PRIVILEGES ON mydatabase.* TO 'dataworks_user'@'<vswitch-cidr-block>' WITH GRANT OPTION;

3. Execute the FLUSH PRIVILEGES; command to refresh privileges, and then exit the database (exit).

Step 5: (Optional) Configure the on-premises firewall

Firewall configurations vary by software. This topic uses firewalld as an example. Adapt these steps for your specific firewall software.

Allow the vSwitch CIDR block bound to the resource group to access the MySQL database:

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<vswitch-cidr-block>" port port="3306" protocol="tcp" accept'
sudo firewall-cmd --reload