Choosing a VPC and Security Group for connecting Amazon External Services to emma compute instances

This guide is designed for users who need to connect AWS External Services to compute instances created in the emma platform. AWS offers various services (e.g., AWS RDS, AWS ElastiCache Redis, AWS MSK) that rely on VPCs (Virtual Private Clouds) and Security Groups to manage connections. To connect an AWS External Service to your emma compute instances, follow these instructions for selecting the appropriate VPC and Security Groups.

After creating an External Service instance, you may want to connect it to another external service or virtual machine. To enable this connection, three requirements must be met:

1. Select the VPC in the emma multi-cloud network.
2. Select the Security Group that you can configure in emma.
3. Configure Security Group rules in emma.

1. Select the VPC

Choose the correct VPC (Virtual Private Cloud) when creating the External Service instance. A VPC is a private network within a cloud provider, and resources in the cloud are hosted within specific VPCs.

There are three types of VPCs in emma:

1. VPCs connected within the emma multi-cloud network: Compute instances from different providers' data centers can be connected.
2. Isolated VPCs: Cannot be used for connecting instances.
3. Provider’s default VPCs: Compute instances can only connect within the same data center.

To ensure your External Service instance is accessible to resources (e.g., virtual machines) located in other AWS data centers, place the instance in a VPC that is part of the emma multi-cloud network.

How to select the VPC in the emma multi-cloud network:

1. Select an AWS virtual machine in the desired location in emma’s portal. This virtual machine should have the "emma multi-cloud network" type (refer to the "Network" field in the General Info tab).
2. Open the AWS virtual machine. A link titled Provider’s Metadata will appear in the top-right corner of the virtual machine interface.
3. Click on the Provider’s Metadata link to view the VPC ID and Security Group ID in AWS.
4. Go to the External Services section in emma, select the external service, and click the Open Console button.
5. In the AWS interface, navigate to the same location as the virtual machine. When creating the External Service instance (e.g., AWS RDS, AWS ElastiCache Redis, AWS MSK), select the VPC ID from the Provider’s Metadata.

Note:

• If you don’t have an AWS virtual machine with an emma multi-cloud network type in the desired data center, you need to create one since there are no VPCs in the multi-cloud network by default.

2. Select the Security Group

A Security Group acts as a virtual firewall that controls inbound and outbound traffic to resources in a virtual network. It uses rules based on IP addresses, protocols, and ports to ensure that only authorized traffic can access your instances.

To enable interaction with your External Service instance, you must assign it a Security Group that can be managed through the emma UI.

Key Notes:

• Not all AWS Security Groups are available in the emma UI.
• You don't have permission to edit Security Groups directly in the cloud provider’s account.
• It’s essential to select a Security Group that can be edited within emma.

How to Select a Security Group:

1. Open the Provider’s Metadata section in the AWS virtual machine to find the Security Group ID in AWS.
2. Assign this Security Group to your External Service instance when creating the instance in the cloud provider’s interface.

3. Configure Security Group Rules

Based on the requirements of your External service, you may need to open certain ports within your security group.

After assigning a Security Group to your External Service instance:

1. Open the Security Groups section in your emma project.
2. Locate and open the Security Group for your virtual machine (and External Service).
3. Edit the inbound and outbound rules as required.
4. Save the changes. The Security Group will automatically sync with the cloud provider (this synchronization may take a few minutes).

Result:

Now, your External Service can connect to AWS compute instances in any data center. If the emma multi-cloud network is enabled, the service can also connect to compute instances in any GCP and Azure data centers.