Skip to main content

Configure Customer Managed Egress

This feature is available only if you are on the Enterprise tier or above.
public preview
This feature is in Public Preview.
info

Customer Managed Egress is currently only available on dedicated AWS clusters.

Astro supports Customer Managed Egress for DAG Workloads on dedicated AWS clusters.

Customer Managed Egress for DAG Workloads lets you control egress to ensure compliance with security standards and regulations, and provides a data loss protection architecture to secure against unauthorized data transfer.

Enabling Customer Managed Egress through a Transit Gateway attachment between Astro and your corporate network allows you to manage and have full visibilty into private and public data flows from your Astro Deployments and from Metrics Export configurations.

info

An icon on Deployments and Deployment details pages indicate when a Deployment is on a cluster with Customer Managed Egress enabled.

Prerequisites​

Step 1: Create a resource share for Transit Gateway with Astro and submit Transit Gateway ID​

  1. In the Organization section of the Astro UI, click Clusters. For an existing dedicated AWS cluster, click the cluster you want to edit. Then, navigate to the Customer Managed Egress for DAG Workloads section of the Cluster Details page.

  2. Click Configure Customer Managed Egress...

  3. Share your Transit Gateway with your Astro cluster account using AWS Resource Access Manager (AWS RAM). Your Astro cluster Account ID is provided to enter into AWS RAM.

  4. Retrieve your AWS Transit Gateway ID from your AWS console.

  5. Enter your AWS Transit Gateway ID into Transit Gateway ID.

Step 2: Astro accepts resource share and creates Transit Gateway attachment​

Monitor the automatically generated Astro support ticket to accept the resource share and confirm Transit Gateway attachment is created. This activity is completed by Astronomer Support, so you do not need to take action during this step.

Step 3: Enable Customer Managed Egress for DAG Workloads​

  1. Enable Customer Managed Egress for DAG Workloads.

  2. Astro routes all public and private traffic to your Transit Gateway from your Astro Deployments and Private Network Egress mode is enabled.

warning

Resetting the Transit Gateway ID disables the routing of workload traffic (public and private) to your Transit Gateway, which might cause task failures. You must re-configure a new Transit Gateway to enable Customer Managed Egress again.

Was this page helpful?