Common tasks for VPC configuration

• •Add trusted IP addresses. If your organization filters based on IP addresses, add the safe Informatica addresses so that they won't get blocked by the firewall. For more information, see Adding trusted Informatica IP addresses.
• •Configure a system disk. A system disk can help improve mapping performance. For guidelines on setting up a system disk, see Configuring a system disk. For directions on setting up the system disk, see System Disk.
• •Create a supplementary file location. If your mappings use JAR files and external libraries, set up a location on Amazon S3 to store the files. For more information, see Creating the supplementary file location.
• •Configure TLS to authenticate REST APIs. If you use a REST V3 Connector, you can configure TLS to authenticate REST APIs. For more information, see Configuring TLS to authenticate REST APIs.

Adding trusted Informatica IP addresses

US

APJ

Canada

EMEA

UK

Configuring a system disk

Rules and guidelines for the EFS file system

• •Set the file system to the ID of the EFS file system.
• •Allow the subnet in the serverless runtime environment to access to the Amazon EFS file system.
• •Configure the EFS security group to allow inbound access from the security group configured in the serverless runtime environment.
• •Configure the IAM role in the serverless environment with full access to the EFS file system. You can grant full access in the file system policy or in the IAM role. For example, the following file system policy allows root access to ServerlessRole (SREIICS) for file system fs-12345 and allows SecureTransport only:
"Version": "2012-10-17",
"Id": "efs-policy-wizard-<efs policy wizard ID>",
"Statement": [
{
"Sid": "efs-statement-<efs statement ID>",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<arn ID>:role/SREIICS"
},
"Action": [
"elasticfilesystem:ClientWrite",
"elasticfilesystem:ClientMount",
"elasticfilesystem:ClientRootAccess"
],
"Resource": "arn:aws:elasticfilesystem:us-west-2: <arn ID>:file-system/fs-12345",
"Condition": {
"Bool": {
"elasticfilesystem:AccessedViaMountTarget": "true"
}
}
},
{
"Sid": "efs-statement-<efs statement ID>",
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Action": "*",
"Resource": "arn:aws:elasticfilesystem:us-west-2: 123456789:file-system/fs-12345",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
]
}
The following table describes the actions in the sample policy:

Action	Description
elasticfilesystem:ClientMount	Provides read-only access to a file system.
elasticfilesystem:ClientWrite	Provides write permissions on a file system.
elasticfilesystem:ClientRootAccess	Provides use of the root user when accessing a file system.

• •Create any folder required by an access point before creating the access point itself. For example, if the access point refers to the folder /my-company/dev, then define this folder first before you set up the access point.
• •Configure the IAM role to restrict access to specific access points on the file system. For more information, see https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html

Rules and guidelines for the NFS file system

• •Set the file system to the DNS of the NFS server.
• •Configure the subnet in the serverless runtime environment to allow access to the NFS file server.
• •Configure the file server security group to allow inbound access from the security group configured in the serverless runtime environment.

Using EFS or NFS directories as data disks

1Mount the EFS or NFS directories in an EC2 instance that you have.
2Log in to the EC2 instance.
3Locate a user with ID=501. If one doesn't exist, create a new user with this ID.
User ID 501 is the user cldagnt, which the serverless runtime environment uses to access mounted EFS or NFS directories.
4Assign read and write permissions to the mounted directories for user 501.
For more information, see the following topic in the AWS documentation: Working with users, groups, and permissions at the Network File System Level.

Configuring a data disk

• •Flat file support. You can use flat files from the mounted EFS or NFS locations in your mappings.
• •Parameter file support. You can use parameter files stored in the mounted EFS or NFS locations. This simplifies migrating jobs from a Secure Agent group to a serverless runtime environment, since you do not need to modify your mappings.

Creating the supplementary file location

1. 1Create the following file structure on Amazon S3:
<Supplementary file location>
├── ext
├── odbc
│ └── lib
└── serverless_agent_config
├── jars
├── SSL
├── j_depends
└── py_depends
2. 2Create a serverlessUserAgentConfig.yml file. For a template, see Populating the serverlessUserAgentConfig.yml File.
3. 3Add the serverlessUserAgentConfig.yml file directly under the serverless_agent_config directory.

Configuring TLS to authenticate REST APIs

1Navigate to the supplementary file location on Amazon S3.
2In the serverless_agent_config folder, create a subfolder called SSL.
3Add the truststore and keystore certificates to the SSL folder.
For one-way secure communication, add the truststore certificates. For two-way secure communication, add both the truststore and keystore certificates.
4 Copy the following code snippet to a text editor and add the relative path to each certificate in the supplementary file location:
version: 1
agent:
agentAutoApply:
general:
sslStore:
- fileCopy:
sourcePath: SSL/<REST V3 truststore certificate name>.jks
- fileCopy:
sourcePath: SSL/<REST V3 keystore certificate name>.jks
5In the serverless_agent_config folder, open the serverlessUserAgentConfig.yml file.
6Add the code snippet to the serverlessUserAgentConfig.yml file and save the file.
The serverless runtime environment will copy the certificates from the supplementary file location to its own reference directory so that it can use the certificates at run time.
7In the REST V3 connection properties, use the following format to specify each truststore and keystore file path in the serverless runtime environment: /home/cldagnt/SystemAgent/serverless/configurations/ssl_store/<certificate name>.jks