Azure PostgreSQL Database Setup Guide

Follow these instructions to replicate your Azure PostgreSQL database to your destination using Fivetran.

---

Prerequisites

To connect your PostgreSQL database to Fivetran, you need:

• PostgreSQL version 9.5 - 14
• Your database host's IP (e.g., 1.2.3.4) or domain (e.g., your.server.com)
• Your database's port (usually 5432)
• TLS enabled on your database

---

Setup instructions

Choose connection method (TLS required)

IMPORTANT: You must have TLS enabled on your database to connect to Fivetran.

Decide whether to connect your Azure PostgreSQL database directly or using an SSH tunnel. How you configure your security groups will differ depending on this decision.

undefined

undefined

Connect using Azure Private Link Beta

IMPORTANT: You must have a Business Critical plan to use Azure Private Link.

Azure Private Link allows Virtual Networks (VNets) and Azure-hosted or on-premises services to communicate with one another without exposing traffic to the public internet. Learn more in Microsoft's .

Follow to configure Private Link for your database.

Enable access

You must configure the firewall to grant Fivetran's data processing servers access to your database server.

1. In the Azure console, open the SQL database firewall settings.

2. Select the Azure PostgreSQL database that you want to connect to Fivetran.

3. In Settings, click Connection security.

   

4. Add a new firewall rule. Enter in both the Start IP and End IP fields to define the firewall rule's range.

   

5. Click Save.

Create user

1. Open a connection to your master PostgreSQL database.

2. Create a user for Fivetran by executing the following SQL command. Replace <username> and some-password with a username and password of your choice.

CREATE USER <username> PASSWORD 'some-password';
content_copy

Grant read-only access

Grant the Fivetran user read-only access to all tables by running the following commands. To grant access to a schema other than PostgreSQL's default public schema, replace public with the schema name.

GRANT USAGE ON SCHEMA "public" TO <username>;
GRANT SELECT ON ALL TABLES IN SCHEMA "public" TO <username>;
ALTER DEFAULT PRIVILEGES IN SCHEMA "public" GRANT SELECT ON TABLES TO <username>;
content_copy

NOTE: The last command makes sure that any future tables will be accessible to Fivetran.

If you want to grant access to multiple schemas, you must run these three commands for each schema.

Restrict access to tables (optional)

If you want to limit Fivetran's access to your data, grant the Fivetran user access to only the tables that you would like to sync. You need to individually grant access for each table that you want to sync. It is not possible to achieve exclusion by granting access to all tables and then revoking access for a subset of tables.

1. Ensure that the Fivetran user has access to the schema that contains your table(s).

   GRANT USAGE ON SCHEMA "some_schema" TO <username>;
   content_copy

2. Revoke any previously granted permission to all tables in that schema.

   ALTER DEFAULT PRIVILEGES IN SCHEMA "some_schema" REVOKE SELECT ON TABLES FROM <username>;
   REVOKE SELECT ON ALL TABLES IN SCHEMA "some_schema" FROM <username>;
   content_copy

3. Repeat the following command for each table you want Fivetran to sync.

   GRANT SELECT ON "some_schema"."some_table" TO <username>;
   content_copy

4. By default, any tables that you create in the future will be excluded from the Fivetran user's access. To grant access to new tables, run the following command.

   ALTER DEFAULT PRIVILEGES IN SCHEMA "some_schema" GRANT SELECT ON TABLES TO <username>;
   content_copy

Restrict access to columns (optional)

You can also grant the Fivetran user access to only certain columns within a table. You need to individually grant access for each column that you want to sync.

NOTE: We need access to the hidden system column xmin for incremental updates.

1. Ensure that you have revoked any previously granted permission to read all columns in the table.

   REVOKE SELECT ON "some_schema"."some_table" FROM <username>;
   content_copy

2. Grant permission to the specific columns you want to sync (for example, some_column and other_column).

   IMPORTANT: You must grant us access to the hidden system column ctid, which we need to perform initial syncs. Also, if you chose XMIN as your incremental update mechanism, you must grant us access to the hidden system column xmin.

   GRANT SELECT (xmin, ctid, some_column, other_column) ON "some_schema"."some_table" TO <username>;
   content_copy

Once you restrict access to columns within a table, the Fivetran user will not have access to any new columns added to that table in the future. To grant access to new columns, you must rerun the command above.

Choose incremental sync mechanism

To keep your data up to date after the initial sync, we use one of the following incremental sync methods:

• SUNSET

The first three methods keep a record of recent data changes, which allows Fivetran to update only the data that has changed since our last sync. Fivetran Teleport Sync instead takes snapshots of tables to calculate differences.

TIP: We recommend using logical replication as your incremental update mechanism because it is faster than XMIN replication and allows Fivetran to detect deleted rows for tables with primary keys. Learn more in our .

Choose logical replication with the pgoutput plugin, logical replication with the test_decoding plugin, XMIN, or Fivetran Teleport Sync as your incremental update mechanism.

• To enable logical replication with the pgoutput plugin, proceed to the .
• To enable logical replication with the test_decoding plugin, proceed to the . SUNSET
• To enable XMIN, proceed to the .
• To enable Fivetran Teleport Sync, proceed to the .

Logical replication with the pgoutput plugin

IMPORTANT: You can only enable logical replication with the pgoutput plugin if your Azure Database for PostgreSQL flexible server's version is 11 or later.

We do not support logical replication with the pgoutput plugin for Azure Database for PostgreSQL single server.

To enable logical replication with the pgoutput plugin, follow these steps:

1. Connect to your master database. You cannot enable logical replication on a read replica.

2. Ensure that your server has ample free space for the logs. Logs that Fivetran has already processed are released. However, logs are not released if replication stops (for example, if we lose access). In this case, logs may accumulate on your server and consume additional storage. The amount of additional disk space consumed by these logs is proportional to the amount of changes committed on the server. If a lost connection can't be resumed quickly enough, you can drop the replication slot, which releases the storage of unconsumed logs. You would then need to do a full re-sync of your connector to reset the cursor in the replication slot.

3. In your Azure portal, do the following:

   i. Set the wal_level server parameter to LOGICAL, then click Save.

   

   ii. Click Yes to restart the server to apply the change.

   

4. Log in to a PostgreSQL console as an admin user.

5. Create a publication for your tables. If you want, you can create a publication for only certain tables so that you add or remove tables from the publication later on. Only changes from tables in the publication are replicated to Fivetran. Each database can have multiple distinct publications. You must have CREATE privileges or above to run this command.

   IMPORTANT: The publication name fivetran_pub quoted throughout this guide is used purely as an example. The actual publication name should be unique for every database and cannot start with a number.

   CREATE PUBLICATION fivetran_pub FOR TABLE table2, table4, table8;
   content_copy

   To add or remove a table from a publication, run the following command. You must have ownership rights over the table(s).

   ALTER PUBLICATION fivetran_pub ADD/DROP TABLE table_name;
   content_copy

   Alternatively, you can create a publication for all of your tables. However, you cannot remove any table from this publication later on. You must have superuser privileges to run this command.

    CREATE PUBLICATION fivetran_pub FOR ALL TABLES;
   content_copy

   (Optional) You can choose which operations to include in the publication. For example, the following publication includes only INSERT and UPDATE operations.

   CREATE PUBLICATION insert_only_pub FOR TABLE table1 WITH (publish = 'INSERT, UPDATE');
   content_copy

   To add partitioned tables for PostgreSQL version 13 or later, run the following command to enable publish_via_partition_root.

   CREATE PUBLICATION fivetran_pub FOR ALL TABLES WITH (publish_via_partition_root=true);
   content_copy

6. Create a logical replication slot for the database you want to sync by running the following command. You must use the standard output plugin pgoutput. Ensure that you are connected to the correct database when you create your replication slot, or your connector will not be able to find the slot.

   To create replication slot, the admin user has to have REPLICATION permission:

   ALTER ROLE <admin_role> WITH REPLICATION;
   content_copy

   IMPORTANT: The replication slot name fivetran_pgoutput_slot quoted throughout this guide is used purely as an example. The actual should be unique for every connector using the same . Replication slot names cannot start with a number.

   IMPORTANT: You need to create the replication slot after you have created the publication.

   SELECT pg_create_logical_replication_slot('fivetran_pgoutput_slot', 'pgoutput');
   content_copy

7. Verify that your chosen tables are in the publication.

   SELECT * FROM pg_publication_tables;
   content_copy

8. Grant the Fivetran user permission to read the replication slot.

   ALTER ROLE fivetran WITH REPLICATION;
   content_copy

9. Log in as the Fivetran user.

10. Verify that the Fivetran user can read the replication slot by running the following command. Replace fivetran_pgoutput_slot with your replication slot name and fivetran_pub with the publication name.

    SELECT count(*) FROM pg_logical_slot_peek_binary_changes('fivetran_pgoutput_slot', null, null, 'proto_version', '1', 'publication_names', 'fivetran_pub');
    content_copy

    If the query succeeds, then permissions are sufficient.

Logical replication with the test_decoding plugin SUNSET

IMPORTANT: You can only enable logical replication with the test_decoding plugin if your Azure PostgreSQL version is 10 or later.

To enable logical replication with the test_decoding plugin, follow these steps:

1. Connect to your master database. You cannot enable logical replication on a read replica.

2. Ensure that your server has ample free space for the logs. Logs that Fivetran has already processed are released. However, logs are not released if replication stops (for example, if we lose access). In this case, logs may accumulate on your server and consume additional storage. The amount of additional disk space consumed by these logs is proportional to the amount of changes committed on the server. If a lost connection can't be resumed quickly enough, you can drop the replication slot, which releases the storage of unconsumed logs. You would then need to do a full re-sync of your connector to reset the cursor in the replication slot.

3. In your Azure portal, do the following:

   i. Set Azure replication support to logical, then click Save.

   

   ii. Click Yes to restart the server to apply the change.

   

   iii. If you are running Postgres 9.5 or 9.6 and use public network access, add a firewall rule to include the public IP address of the client used to run the logical replication. The firewall rule name must include _replrule. For example, fivetran_replrule. Add the rule and click Save.

   

4. Log into a PostgreSQL console as a superuser (one that has the rds_superuser role).

5. Create a logical replication slot for the database you want to sync by running the following command. You must use the output plugin test_decoding supplied in the postgresql-contrib subpackage. Ensure that you are connected to the correct database when you create your replication slot, or your connector will not be able to find the slot.

   IMPORTANT: The replication slot name fivetran_replication_slot quoted throughout this guide is used purely as an example. The actual should be unique for every connector using the same . Replication slot names cannot start with a number.

   SELECT pg_create_logical_replication_slot('fivetran_replication_slot', 'test_decoding');
   content_copy

6. Grant permission to the Fivetran user for reading the replication slot.

   ALTER ROLE fivetran WITH REPLICATION;
   content_copy

7. Log in as the Fivetran user.

8. Verify that the Fivetran user can read the replication slot by running the following command.

   SELECT count(*) FROM pg_logical_slot_peek_changes('fivetran_replication_slot', null, null);
   content_copy

If the query succeeds, then permissions are sufficient.

XMIN

You do not need to do any additional configuration for the XMIN method. You must use the XMIN method if your Azure PostgreSQL version is earlier than 10.

Fivetran Teleport Sync

If you are trying to connect with a standby or read replica, run the following SQL commands:

CREATE AGGREGATE BIT_XOR(IN v bigint) (SFUNC = int8xor, STYPE = bigint);
content_copy

If you are not connecting with a read replica, you do not need to do any additional configuration. The aggregate that the Teleport mechanism will later use is automatically created for you.

Finish Fivetran configuration

1. In your , enter a destination schema prefix. This prefix applies to each replicated schema and cannot be changed once your connector is created.

2. In the Host field, enter your database host's IP (for example, 1.2.3.4) or domain (for example, your-database.cp0rdhwjbsae.us-east-1.rds.amazonaws.com)

3. Enter your database instance's port number. The port should be 5432, unless you changed the default.

4. For the User, enter the username:

   • If you are connecting with Flexible Server, enter <username>.
   • If you are connecting with Single Server, enter <username>@<servername>, where <servername> is part of your Azure host URL: <servername>.database.windows.net.

5. Enter the password for the Fivetran-specific user that you created in .

6. Enter the name of the database that you want to replicate from (for example, your_database).

7. Choose your connection method. If you selected Connect via an SSH tunnel, provide the following information:

   • SSH host (do not use a load balancer's IP address/hostname)
   • SSH port
   • SSH user

8. Choose your update method. If you selected Logical replication of the WAL using the test_decoding plugin, enter the name of your database's replication slot. If you selected Logical replication of the WAL using pgoutput plugin, enter both the name of your database's replication slot and publication name accordingly.

9. Click Save & Test. Fivetran tests and validates our connection to your Azure PostgreSQL database. Upon successful completion of the setup tests, you can sync your data using Fivetran.

---

Setup tests

Fivetran performs the following tests to ensure that we can connect to your Azure PostgreSQL database and that it is properly configured:

• The Connecting to SSH Tunnel Test validates the SSH tunnel details you provided in the setup form. It then checks that we can connect to your database using the SSH Tunnel. (We skip this test if you aren't connecting using SSH.)
• The Connecting to Host Test validates the database credentials you provided in the setup form. The test verifies that the host is not private and then checks the connectivity to the host.
• The Validating Certificate Test generates a pop-up window where you must choose which certificate you want Fivetran to use. It then validates that certificate and checks that we can connect to your database using TLS. (We skip this test if you aren't connecting directly.)
• The Connecting to Database Test checks that we can access your database.
• The Connecting to WAL Replication Slot Test confirms that the database associated with the replication slot matches the name you supplied in the setup form. It then verifies that the replication slot uses the pgoutput if you selected WAL with pgoutput update method, or the test_decoding plugin if you selected WAL with test_decoding update method. Lastly, it makes sure that the Fivetran user has replication privileges. (We skip this test if you selected XMIN as your incremental update mechanism)
• The Checking Configuration Values Test checks a set of WAL-configured values against the recommended settings and detects if they are below the recommended range. (We skip this test if you selected XMIN as your incremental update mechanism.)
• The Publication Test verifies that the supplied publication name exists in your database. (We skip this test if you selected XMIN or WAL with test_decoding plugin as your incremental update mechanism.)
• The Validating Speed Setup test validates Fivetran can fetch data from your source database quickly enough. During this test, we measure our ability to download sample data from your source database to Fivetran, but we do not perform a full sync. We start a timer, then download the sample data in memory. We then calculate the connector speed based on how much data we downloaded and how long it took to download. The test shows a warning if the download speed is less than 5MB/sec.
• The XMIN Extensions test checks that the correct extensions are enabled for XMIN. (This test is skipped if you did not select XMIN as your incremental update mechanism.)

NOTE: The tests may take a few minutes to finish running.

---

Related articles