Aurora MySQL Destination Setup Guide

Follow our setup guide to connect Aurora MySQL database as a destination to Fivetran.

---

Prerequisites

To connect Aurora MySQL to Fivetran, you need the following:

• MySQL version 5.5 or above (5.5.40 is the earliest version tested)
• Database host's IP (e.g., 1.2.3.4) or host (your.server.com)
• Port (usually 3306)
• Database administrator permissions to create a Fivetran-specific MySQL user
• Fivetran role with the permissions
• Provide at least 1024MB for innodb_buffer_pool_size. For more information about innodb_buffer_pool_size, see .
• Set the local_infile system variable to ON. For more infomation about local_infile, see . Check the variable status with SHOW GLOBAL VARIABLES LIKE 'local_infile' and switch the status to ON with SET GLOBAL local_infile = true.

---

Setup instructions

Choose connection method

Decide whether to connect to your Aurora MySQL database directly or using an SSH tunnel. For more information, see our .

Connect directly

If you connect directly, you must create a rule in a security group that allows Fivetran access to your database instance and port.

Configure your firewall and/or other access control systems to allow:

• incoming connections to your host and port (usually 3306) from for your database's region
• outgoing connections from all ports (1024 to 65535) to

Connect using an SSH tunnel

If you connect using an SSH tunnel, Fivetran connects to a separate server in your network that provides an SSH tunnel to your Aurora MySQL database. You must configure your tunnel server's security group to allow Fivetran access and configure the instance's security to allow access from the tunnel.

You must connect through SSH if your database is contained within an inaccessible subnet.

To connect using SSH, do the following:

1. In the , select the Connect via an SSH tunnel option.

2. Copy Fivetran's public SSH key.

3. Add the public key to the authorized_keys file of your SSH server. The key must be all on one line, so make sure that you don't introduce any line breaks when cutting and pasting.

Connect using AWS PrivateLink Beta

IMPORTANT: You must have a Business Critical plan to use AWS PrivateLink.

AWS PrivateLink allows VPCs and AWS-hosted or on-premises services to communicate with one another without exposing traffic to the public internet. PrivateLink is the most secure connection method. Learn more in .

Follow to configure PrivateLink for your destination.

Allow Fivetran access

You must allow Fivetran access to your Aurora MySQL database:

• If your instance is in a Virtual Private Cloud (VPC), you must configure:

  • VPC Security Groups
  • Network Access Control Lists (ACLs)

• If your instance is not in a VPC, then you only need to configure Security Groups

Enable public access

1. Log in to your .

2. In the Databases pane, expand the view on the database.

   

3. In the Connectivity & security tab, make sure that the Public Accessibility field is set to Yes. If the field is set to No, contact .

   

4. Make a note of the Endpoint (host name) and Port number. You will need them to configure Fivetran.

   

Configure security group

The following instructions assume that your database is in a VPC.

NOTE: You can use these instructions to configure a non-VPC security group because the process is almost identical.

1. In the Connectivity & security tab, click the VPC security groups link.

   

2. In the Security Groups section, go to the Inbound rules tab.

   

3. Click Edit inbound rules.

   

4. Click Add Rule.

   

   A new Custom TCP Rule is created at the bottom of the list with a blank space for a Port Range and a Source IP address.

5. Enter the following details:

   • In the Port Range field, enter the port number that you noted earlier (usually 3306)
   • In the Source field, select Custom IP and then enter

   

6. Click Save rules.

   

Configure Network ACLs

1. Return to the RDS dashboard and expand the view on the database.

   

2. Click the VPC link.

   

3. Select the VPC ID link.

   

4. In the Summary tab, click the Main network ACL link.

   

5. Go to the Inbound Rules tab.

   

   • If you have a default VPC that was automatically created by AWS, then the settings already allow all incoming traffic as indicated by the Source value 0.0.0.0/0 and the fact that the ALLOW entry is listed above the DENY entry.

     

   • If your inbound rules don't include an ALL - 0.0.0.0/0 - ALLOW entry, edit the rules to allow to access the port number of your database (usually 3306).

   NOTE: See for more information.

6. Go to the Outbound Rules tab.

   

   • If your outbound rules don't include an ALL - 0.0.0.0/0 - ALLOW entry, click Edit to edit the rules to allow outbound traffic to all ports 1024-65535 for Destination.

Create Fivetran user

Create a Fivetran user in your MySQL database:

1. Open a connection to your MySQL database using your SQL tool (MySQL Workbench or the mysql command line interface).

2. Execute the following query to create a user for Fivetran. Choose a memorable username (for example, fivetran). Replace <password> with a password of your choice:

   CREATE USER fivetran@'%' IDENTIFIED BY 'password';
   GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, ALTER, CREATE TEMPORARY TABLES, CREATE VIEW ON *.* TO fivetran@'%';
   content_copy

Complete Fivetran configuration

1. Log in to your Fivetran account.
2. Go to the , then click + Add Destination.
3. On the Add destination to your account page, enter a Destination name of your choice.
4. Click Add.
5. Select Aurora MySQL as the destination type.
6. In the destination setup form, enter the Host name or the IP address of the database server.
7. Enter the Port number. For example, 5432.
8. Enter the User name you created in .
9. Enter the Password you created in .
10. Choose your Connection method:
    • Connect directly
    • Connect via an SSH
    • Connect via Private Networking
11. If you choose Connect via an SSH tunnel in the Connection method drop-down menu, enter the following details:
    • SSH Host
    • SSH Port
    • SSH User
    • (Optional) Enable the Require TLS through tunnel toggle if you want to use TLS.
12. Choose the Data processing location. Depending on the plan you are on and your selected cloud service provider, you may also need to choose a Cloud service provider and cloud region as described in our .

    IMPORTANT: If you are using , select AWS in the Cloud service provider drop-down menu.

13. Choose your Time zone.
14. (Optional for Business Critical accounts) To enable , set the Use Failover toggle to ON, and then select your Failover Location and Failover Region. Make note of the IP addresses of the secondary region and safelist these addresses in your firewall.
15. Click Save & Test.

Fivetran the Aurora MySQL destination connection. On successful completion of the setup tests, you can sync your data using Fivetran connectors to the Aurora MySQL destination.

Setup tests

Fivetran performs the following Aurora MySQL connection tests:

• The SSH Tunnel Test validates the SSH tunnel details you provided in the setup form and then checks the connectivity to the instance using the SSH Tunnel if you are connecting using an SSH tunnel.
• The Database Host Connection Test validates the database credentials you provided in the setup form. The test verifies that the host is not private and then checks the connectivity to the host.
• The Database Certificate Validation Test generates a pop-up window where you must choose which certificate you want Fivetran to use. The test then validates that certificate and checks that we can connect to your database using TLS. We skip this test if you aren't connecting directly.
• The Permission Test checks that we have the correct permissions to create schemas and tables in your database.
• The Warehouse User Test checks if:
  • we can access the TABLES, COLUMNS, and KEY_COLUMN_USAGE tables in the INFORMATION_SCHEMA
  • the local_infile variable is ON
  • the innodb_buffer_pool_size is greater than 1024 MB

---

Related articles