July 26th, 2021

Machine translation is used partially for this article. See the Japanese version for the original article.

Introduction

In Amazon Web Services (hereinafter called "AWS"), we tried building an HA cluster using VPC endpoint.

A VPC endpoint is an AWS service that allows you to privately connect a VPC to other AWS services without having to go over the Internet.

This time, we will build an "HA cluster based on VIP control" with a private connection using the VPC endpoint.
(HA cluster based on VIP control is one of the cluster configurations using EXPRESSCLUSTER on AWS.)

Contents

1. VPC Endpoint

A VPC endpoint is an AWS service that allows you to connect VPC and other AWS services privately without having to go through an Internet gateway, NAT gateway, NAT instance, etc.

For example, when accessing S3 from an EC2 instance placed in a VPC, accessing S3 from an EC2 instance can be achieved through a private access path that does not go over the Internet by using the VPC endpoint.

The benefits of using VPC endpoints is follow:

2. HA Cluster Configuration

The HA cluster configuration is a two-node mirror disk type, and is a "HA cluster based on VIP control" using AWS Virtual IP Resources.

HA cluster based on VIP control configuration requires the instance to communicate with the region endpoint through HTTPS in order for the instance to perform VIP control processing by AWS CLI.

In the above configuration, the instance accesses AWS services (Amazon EC2 APIs) without access to the Internet through the VPC endpoint.

Windows and Linux are available for the instances that make up the HA cluster. This time, we will build a HA cluster using Linux for instance.

From now on, the instance assumes that you have installed the AWS CLI, set up the region, set the security key, and set up the network.

3. HA Cluster Building Procedure

3.1 Preparation for HA Cluster Construction

Create a VPC in advance. The configuration of the VPC is as follows:

3.2 Creating VPC Endpoints

This time, I'm going to create a VPC endpoint using AWS CLI (AWS CLI version is "1.14.3").
AWS CLI, like the AWS Management Console, does not need to run from an environment with EXPRESSCLUSTER X installed and can be run from any environment.

From now on, the result of executing the command described will be the result of running on Linux. Basically, it is the same in Windows.

3.2.1 VPC Settings

Set up the VPC. Run the following command to set the DNS resolution attribute of the VPC to Yes.

Run the following command to set the DNS host name attribute of the VPC to Yes.

3.2.2 Creating Security Groups

Create a security group to associate with the VPC endpoint.
The AWS EC2 API allows security groups to control access to VPC endpoints.
Each instance must communicate https to the region endpoint to run the AWS CLI, and the security group allows communication at HTTPS.

First, run the following command to create a security group for your pre-created VPC (vpc-1234abcd).

Then run the following command to add a rule that allows HTTPS to communicate with the inbound rules of the security group. For outbound, leave the default and do not add or delete any rules.

3.2.3 Creating VPC Endpoints

The service name specified by the VPC endpoint varies for each AWS service used.

Run the following command to verify the service name that corresponds to the Amazon EC2 API from the list of service names available on the VPC endpoint. Make a note of the name of the service you have checked here, as it will be used in the procedure described below.
(* The aws service name used this time is "com.amazonaws.us-east-1.ec2".)

Run the following command to create a VPC endpoint.

After you create the VPC endpoint, verify that the AWS CLI can run from each instance that configures the HA cluster.

Run the command below to verify that the VPC information is displayed.

3.3 Creating an HA Cluster Based on VIP Control

Create a "HA cluster based on VIP control". EXPRESSCLUSTER failover groups only register AWS Virtual IP Resources and Mirror Disk Resources.

For the configuration procedure, see "EXPRESSCLUSTER X for Windows HA Cluster Configuration Guide for Amazon Web Services".

The following is an example of EXPRESSCLUSTER configuration when Linux is used as the instance that makes up a HA cluster.

4. Checking the Operation

Connect to Cluster WebUI with the virtual IP address (20.0.0.100) you set in AWS Virtual IP Resources and verify that it is working properly. Also, if the failover group is failed over to the standby server, make sure that you can still connect with the same virtual IP address(20.0.0.100).

Conclusion

This time, we introduced the procedure for building a HA cluster with a private connection using VPC endpoints.
Using the VPC endpoint, we were able to confirm that a HA cluster that does not access the Internet from a private subnet can be built.

If you consider introducing the configuration described in this article, you can perform a validation with the trial module of EXPRESSCLUSTER. Please do not hesitate to contact us if you have any questions.