Create a private connectivity configuration for the source database

This page describes how to create a private connectivity configuration. Private connectivity configuration is a Database Migration Service construct that helps establish connectivity between Database Migration Service service network and your project's Virtual Private Cloud (VPC) network. You create private connectivity configurations to establish private connections to source SQL Server databases.

You can create two types of private connectivity configurations:

• For Private Service Connect interfaces connectivity
• For VPC peering connectivity

For more information about network connectivity in Database Migration Service, see Network connectivity for heterogeneous SQL Server migrations and Source networking methods overview.

Before you begin

1. Ensure you have a Virtual Private Cloud network that meets the following requirements:
   • The VPC network doesn't have any peering restrictions.
   • It's the same network where your source database is peered. For more information, see the requirements section in Private connectivity with VPC peering.
   • The VPC network has an available IP range with a CIDR block of /29. Database Migration Service uses this IP range to create a subnet so that it can communicate with the source database.
2. Enable the Database Migration Service and Compute Engine APIs.

   Enable the APIs

Required roles

To get the permissions that you need to create a private connectivity configuration, ask your administrator to grant you the required IAM roles on your project:

• To create a network attachment and manage private connectivity configurations:

  • Database Migration Admin (roles/datamigration.admin)
  • Compute Network Viewer (roles/compute.networkViewer)

• If you need to create a private connectivity configuration using a network attachment or its underlying subnetwork in a different project than Database Migration Service (for example, if you use a Shared VPC host project), then you need to grant the following role to the Database Migration Service service account (service-PROJECT_NUMBER@gcp-sa-datamigration.iam.gserviceaccount.com):

  • Compute Network Admin (roles/compute.networkAdmin)

  Alternatively, if the Database Migration Service project is already on the network attachment's accepted projects list, then granting the Compute Network Viewer (roles/compute.networkViewer) role is sufficient.

For more information about granting roles, see Manage access in the Identity and Access Management documentation.

These predefined roles contain the permissions required to create a private connectivity configuration in Database Migration Service. To see the exact permissions that are required, expand the Required permissions section:

You might also be able to get these permissions with custom roles or other predefined roles.

Create a configuration for Private Service Connect interfaces

To create a private connectivity configuration to use with Private Service Connect interfaces, follow these steps:

1. Make sure you first create a network attachment in your VPC network. Use a subnet with at least 6 free usable IP addresses for Database Migration Service (that is, a /29 range). For more information, see Private connectivity with Private Service Connect interfaces.
2. In the Google Cloud console, go to the Private connectivity configurations page.

   Go to Private connectivity configurations

3. Click Create configuration.

4. In the