# AWS x DirectConnect Integration Guide

## AWS x DirectConnect Integration Setup Guide

Connect your AWS environment (VPC, RDS, S3, etc.) to the Relyance AI platform over a private, encrypted connection (site-to-site VPN).

### What You’ll Need

Before you start, make sure you have:

- An AWS VPC (Virtual Private Cloud)
- Permission to create:
    - Customer Gateways
    - Site-to-Site VPN connections
    - Virtual Private Gateway (VGW) or Transit Gateway (TGW)
    - Route 53 inbound resolver endpoint
- The ability to share with Relyance:
    - External IPs
    - ASN
    - VPN configuration file
- CIDR range for your GKE pods (provided by Relyance)

### Step 1: Create the VPN Connection

This step builds a private tunnel between your AWS environment and the Relyance platform. The flow is also well-documented in AWS’s [“Get started with AWS Site-to-Site VPN.”](https://docs.aws.amazon.com/vpn/latest/s2svpn/SetUpVPNConnections.html)

#### Relyance Will

- Create the VPN Gateway and Cloud Router in GCP
- Provide:
    - Two external IPs
    - GCP ASN: 65000
    - Pre-shared key (PSK)

#### You Will

1. Create Customer Gateways in AWS using the IPs provided by Relyance.
2. Create a Virtual Private Gateway (VGW) or Transit Gateway (TGW) and attach it to your VPC. Use a VGW for a simple, cost-effective connection to a single VPC. Use a TGW if you need to connect multiple VPCs or AWS accounts and want centralized routing management.
3. Create a Site-to-Site VPN Connection linking the gateways.
4. Configure your BGP ASN.
5. Download the VPN configuration file and share it with Relyance.

#### Reference Documentation

- [AWS doc](https://docs.aws.amazon.com/vpn/latest/s2svpn/SetUpVPNConnections.html): *Get started with AWS Site-to-Site VPN*
- [AWS doc](https://docs.aws.amazon.com/vpn/latest/s2svpn/how_it_works.html): *How AWS Site-to-Site VPN works*
- [AWS doc](https://docs.aws.amazon.com/vpn/latest/s2svpn/Examples.html): *Site-to-Site VPN architectural examples*
- Additional official documentation from Google Cloud [is here](https://cloud.google.com/network-connectivity/docs/vpn/tutorials/create-ha-vpn-connections-google-cloud-aws).

### Step 2: Enable Private DNS Resolution

Some AWS services might use DNS names that are only accessible within AWS. DNS forwarding over the VPN lets these resolve in Relyance GCP.

#### You Will

1. Create a Route 53 Inbound Resolver Endpoint. Documented in [AWS reference documentation](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-getting-started.html).
    - Deploy in two Availability Zones
    - Allow port 53 TCP/UDP from 35.199.192.0/19
    - Share the two ENI IPs with Relyance
2. Update your Route Tables (if needed) to route 35.199.192.0/19 to the VPN Gateway
3. Create VPC Endpoints for the services you are connecting with.

#### Relyance Will

- Advertise the DNS forwarding range over BGP
- Create a Cloud DNS forwarding zone to your resolvers
- Test resolution from our GKE pods and confirm if tunnel is working.

#### Reference Documentation

- [AWS Doc](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-getting-started.html): *Getting started with Route 53 Resolver*

### Step 3: Configure Security Groups

To allow Relyance services to reach your workloads over the VPN, please add the following inbound rules to the security group(s) attached to your RDS or other target services:

#### You Will

Add inbound rules to the security group(s) attached to your RDS or other target services:

- Database traffic type: Custom TCP (based on your database engine)
    - Examples:

- PostgreSQL (TCP 5432)
- MySQL (TCP 3306)
- MSSQL (TCP 1433)

- Source: `<Your tenant-specific GKE pod CIDR>` (provided by Relyance)
- Purpose: Allows Relyance GKE pods to connect to your database

#### Relyance Will

- Provide your tenant-specific GKE pod CIDR range
- Validate DNS resolution of your RDS hostname from our GKE pods

#### Reference Documentation

- [AWS Doc](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html): *Amazon VPC Security Groups Overview*
- [AWS Doc](https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html): *Add or Edit Rules in a Security Group*

### Step 4: Relyance to Confirm Setup

Relyance will confirm if the setup is working from Relyance’s GKE pods.

### After Setup

With the VPN and BGP routing in place, Relyance should be securely able to access:

- Amazon RDS databases
- Amazon S3 (via VPC endpoint)
- EC2 instances
- EKS clusters
- Other services as required.

### Need Help?

Contact your Relyance representative if you have any questions during setup.