Serverless setup using AWS cross-account elastic network interfaces

1. 1Set up your AWS environment to create and configure the required AWS resources.
2. 2In Administrator, create a serverless runtime environment to deploy it to AWS.
3. 3If your organization uses an outgoing proxy server to connect to the internet, you can configure the serverless runtime environment to connect to Informatica Intelligent Cloud Services through the proxy server.
4. 4Prepare for disaster recovery by setting up a temporary serverless runtime environment where you can redirect jobs as part of your organization's disaster recovery plan.

Set up the AWS environment

1. 1Create and configure AWS resources to connect to the serverless runtime environment.
2. 2Configure VPC to VPC connectivity to access data across VPCs.
3. 3Create an IAM role that the serverless runtime environment and advanced cluster worker nodes can use to create, attach, detach, and delete the ENI that's associated with the private subnet in your VPC.
4. 4Create a system disk to improve mapping performance in Data Integration.
5. 5Create a data disk if you have files on Amazon EFS or an NFS file server that you want to use in tasks.
6. 6If tasks use JAR files and external libraries, dedicate a location on Amazon S3 to store the files and create folders for each file type.
7. 7If your organization allows only trusted IP addresses, add the IP addresses for the Informatica NAT gateway to the trusted list.

Step 1. Create AWS resources

VPC

A VPC is a virtual network that contains other AWS resources. You can use an existing VPC or create a VPC.

Enable DNS hostnames and DNS resolution for the VPC. Also, ensure that at least one of the following scenarios applies to you:

• - Your VPC's DHCP option is set with AmazonProvidedDNS.
• - If you have custom DNS servers in your DHCP option set, ensure that AmazonProvidedDNs is part of the option set or that the DNS servers can resolve EC2 internal hostnames. To ensure that the DNS servers can resolve EC2 internal hostnames, internally redirect the DNS query to AmazonProvidedDNS.

Public subnet for internet access

A public subnet provides internet access through a NAT gateway. To create the public subnet, use the following guidelines:

• - Use any availability zone in the region where you created the VPC.
• - The CIDR range must be within the VPC CIDR range. Choose a range based on the number of IP addresses that you want to have within the subnet.

Private subnet to host the ENI

A private subnet hosts the ENI that the serverless runtime environment uses to connect to your VPC.

Create a private subnet and configure a CIDR range to determine the maximum number of IP addresses and therefore, the scalability, of the serverless runtime environment. Configure the CIDR range to have at least 25 IP addresses per serverless runtime environment so that the serverless runtime environment can scale effectively when developers run concurrent workloads.

After your organization administrator creates a serverless runtime environment in Administrator, the serverless runtime environment creates an ENI in your private subnet.

Security group

A security group controls the traffic flow from the serverless runtime environment. Create a security group in the VPC. The security group is associated with all ENIs that the serverless runtime environment creates.

To create the security group, use the following guidelines:

• - Leave the inbound rules empty to restrict all incoming traffic.
• - The outbound rules can either allow all traffic or limit traffic to all Amazon S3 resources and all source and target systems that the serverless runtime environment accesses.

You specify this security group in the serverless runtime environment properties in Administrator.

NAT gateway for internet access from the private subnet

A NAT gateway allows outbound traffic to the internet from private instances. All compute instances in the serverless runtime environment that are associated with the ENI are private.

Create a NAT gateway to route outbound traffic from the private subnet to the internet. AWS provides several ways to configure subnet routing rules, such as route tables and NACL. For more information, see the AWS documentation.

Step 2. Configure VPC to VPC connectivity (optional)

Step 3. Create an IAM role

Step 4. Create a system disk

Creating a system disk on Amazon EFS

• •Create any folder required by an access point before creating the access point itself. For example, if the access point refers to the folder /my-company/dev, then define this folder first before you set up the access point.
• •Configure connectivity between the subnet in the serverless runtime environment and the EFS file system.
• •Configure the EFS security group to allow inbound access from the security group of the serverless runtime environment.
• •Create an IAM role with full access to the EFS file system.
For example, the following file system policy allows root access to the serverless role for file system fs-12345 and allows SecureTransport only:
"Version": "2012-10-17",
"Id": "efs-policy-wizard-<EFS policy wizard ID>",
"Statement": [
{
"Sid": "efs-statement-<EFS statement ID>",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<ARN ID>:role/<serverless role>"
},
"Action": [
"elasticfilesystem:ClientWrite",
"elasticfilesystem:ClientMount",
"elasticfilesystem:ClientRootAccess"
],
"Resource": "arn:aws:elasticfilesystem:us-west-2:<ARN ID>:file-system/fs-12345",
"Condition": {
"Bool": {
"elasticfilesystem:AccessedViaMountTarget": "true"
}
}
},
{
"Sid": "efs-statement-<EFS statement ID>",
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Action": "*",
"Resource": "arn:aws:elasticfilesystem:us-west-2:123456789:file-system/fs-12345",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
]
}
The following table describes the actions in the policy:

Action	Description
elasticfilesystem:ClientMount	Provides read-only access to a file system.
elasticfilesystem:ClientWrite	Provides write permissions on a file system.
elasticfilesystem:ClientRootAccess	Provides use of the root user when accessing a file system.

• •Configure the IAM role to restrict access to specific access points on the file system. For more information, see the AWS documentation.

Creating a system disk using an NFS

• •Set the file system to the DNS of the NFS server.
• •Configure connectivity between the subnet in the serverless runtime environment and the NFS file server.
• •Configure the NFS security group to allow inbound access from the security group of the serverless runtime environment.

Step 5. Create a data disk

• •Flat files for a flat file connection in tasks
• •Parameter files for mapping tasks

1Mount the Amazon EFS or NFS directory on an Amazon EC2 instance.
2Log in to the EC2 instance.
3Search for a user with ID 501. If the user doesn't exist, create a user with this ID.
User ID 501 corresponds to the user cldagnt. The serverless runtime environment uses this user to access mounted EFS or NFS directories.
4Assign read and write permissions for the mounted directories to the user with ID 501.

Step 6. Create a supplementary file location

1. 1Create the following file structure on Amazon S3:
<Supplementary file location>
├── ext
├── odbc
│ └── lib
└── serverless_agent_config
├── jars
├── SSL
├── j_depends
└── py_depends
2. 2Create a serverlessUserAgentConfig.yml file. For more information, see Configure the serverlessUserAgentConfig.yml file.
3. 3Add the serverlessUserAgentConfig.yml file directly under the serverless_agent_config directory.

Step 7. Add trusted Informatica IP addresses

Create a serverless runtime environment

1In Administrator, open the Serverless Environments page.
2Select New Serverless Runtime Environment.
3Select AWS Cross-account elastic network interface.
4Configure the serverless runtime environment properties.
For information about how to configure the properties, see Serverless runtime environment properties.
5To save and deploy the serverless runtime environment, select Save.

Serverless runtime environment properties

Basic configuration

Platform configuration

System disk

Data disk

Set up a proxy server

Configuring the proxy in the serverlessUserAgentConfig.yml file

Configuring the proxy in the JVM options

1On the Serverless Environments page, click the name of the serverless runtime environment.
2Click Edit.
3In the Runtime Configuration Properties section, select the Service as Data Integration Server and the Type as DTM.
4Edit any of the JVMOption fields and specify appropriate values for each parameter based on whether you use an HTTPS or HTTP proxy server.
The following table describes the parameters:

Parameter	Description
-Dhttp.proxySet=	Determines if the serverless runtime environment must use the proxy settings when the outgoing proxy server is HTTP. Select -Dhttp.proxySet=True to use the proxy.
-Dhttps.proxySet=	Determines if the serverless runtime environment must use the proxy settings when the outgoing proxy server is HTTPS. Select -Dhttps.proxySet=True to use the proxy.
-Dhttp.proxyHost=	Host name of the outgoing HTTP proxy server.
-Dhttp.proxyPort=	Port number of the outgoing HTTP proxy server.
-Dhttp.proxyUser=	Authenticated user name for the HTTP proxy server.
-Dhttp.proxyPassword=	Password for the authenticated user.
-Dhttps.proxyHost=	Host name of the outgoing HTTPS proxy server.
-Dhttps.proxyPort=	Port number of the outgoing HTTPS proxy server.
-Dhttps.proxyUser=	Authenticated user name for the HTTPS proxy server.
-Dhttps.proxyPassword=	Password for the authenticated user.

5Click Save.

Allowing domains in the proxy server

Prepare for disaster recovery

Disaster recovery procedure

1. 1Create a temporary serverless runtime environment in a stable region or availability zone.
2. 2Make sure that the connections used in jobs are available in the stable region or availability zone.
3. 3Clean up data related to incomplete job runs. If data was partially loaded to a target, manually delete the data or update the mapping to truncate the target before writing new rows.
4. 4Redirect jobs to the temporary environment.

Restoring the primary environment

1. 1Clean up the ENIs that were created in your AWS account for the primary environment.
2. 2Redeploy the primary environment.
3. 3Redirect jobs to the primary environment.
4. 4Delete the temporary environment.

Serverless runtime environment validation

Working with serverless runtime environments using AWS cross-account elastic network interfaces

• •Edit the serverless runtime environment properties
• •Clone the serverless runtime environment
• •Configure Secure Agent services
• •Delete the serverless runtime environment
• •Redeploy the serverless runtime environment
• •Reduce the number of simultaneous tasks
• •Set default directories for Data Integration

Edit the serverless runtime environment

Clone the serverless runtime environment

Configure Secure Agent services

Delete the serverless runtime environment

1In Monitor, verify that the environment is not running any jobs.
2Update the tasks, mappings, and connections that use the serverless runtime environment.
1. aIn Administrator, open the Serverless Environments page.
2. bExpand the Actions menu for the serverless runtime environment and select Show Dependencies.
3. cIf any tasks, mappings, or connections use the serverless runtime environment, navigate to each asset and update the runtime environment that it uses.
3In Administrator, expand the Actions menu for the serverless runtime environment and select Delete.

Redeploy the serverless runtime environment

• •You change your organization's licenses.
• •The serverless runtime environment shuts down because the organization ran out of serverless compute units. You can add more compute units to your organization and redeploy the serverless runtime environment.
• •The serverless runtime environment status is Failed.

1In Monitor, verify that no jobs are running in the runtime environment.
2In Administrator, open the Serverless Environments page.
3Expand the Actions menu for the servleress runtime environment and select Redeploy.

Reduce the number of simultaneous tasks

1In Administrator, open the Serverless Environments page.
2Drill down on the serverless runtime environment.
3On the Runtime Configuration tab, set the service to Data_Integration_Server and the type to Tomcat to filter the list of properties.
4Edit the maxDTMProcesses property.
You can set the property to a value between 1 and 150.

Set default directories for Data Integration