Assigning static IP to AWS Glue jobs
Tags: aws, azure, cloud, networking
Published: 2023-12-05 15:06:57

Our situation was a desire to run AWS Glue ETL (extract, transform, load) jobs where the data source is SQL Server in Azure that has an IP-whitelist firewall.

As AWS Glue is a serverless data integration service, it wasn't reasonable to maintain a range of public IP addresses that we should whitelist in the Azure firewall. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8esa24oaxy30o2aqbvpl.png)

Inspired by [this StackOverflow answer](https://stackoverflow.com/a/64414639/3024923), it's possible to create a Glue connection where all traffic to external resources (like Azure) will use an assigned Elastic IP address.

In this post, I'll expand on their workaround with detailed steps and screenshots for the AWS console.

1. Head to the [VPC console](https://console.aws.amazon.com/vpcconsole/home) and hit **Create VPC** in your desired region.
2. Look for and select the **VPC and more** option which will help us to also create necessary subnets, route tables, and network connections - you can see these under the Preview section.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yffcv8r4wqkqah1apyto.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1c0peqs9v1d3kkr0600t.png)
3. Configure other options the way you prefer but most importantly select **1 public subnet and 1 private subnet**. Hit **Create VPC**.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ui2logl61p1xn12m4o48.png)
4. With the VPC and other essentials created, take note that the subnets, and route tables created for us have a similar name to the VPC name we provided in Step 2 (e.g, `glue-demo`).
5. Head to [create a NAT gateway](https://console.aws.amazon.com/vpcconsole/home#CreateNatGateway:). Select the **public subnet in which to create the NAT gateway**, keep **connectivity type as Public**. Here we will **allocate an Elastic IP** to the NAT gateway - this will be the IP inserted into our whitelist in Azure!
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ia03czpippra9w5d3u4b.png)
6. Navigate to [Route tables](https://console.aws.amazon.com/vpcconsole/home#RouteTables:v=3), and at this point it's handy to filter resources by VPC.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7xu4f57q77nfsseem329.png)
7. Select the route table that is associated with your **private subnet** - the route table conveniently should've included **private** in its name tag.
8. **Edit routes** for the private route table and add a route with all destinations (AKA `0.0.0.0/0`) with target of our NAT gateway created in Step 5.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/98nhs2ctpzybcaiujnwr.png)
9. We're now ready to head into AWS Glue and [create a connection](https://console.aws.amazon.com/gluestudio/home#/connector/create-glue-connection-v2). We'll select Azure SQL DB as our data source here, but this should work for any other source (e.g, Snowflake).
10. I won't get into details of the data source connection (Azure SQL URL, etc) however we'll pay attention the the **Network options** section.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jxl64d2mlsbhw4qknvqd.png)
11. Here we'll choose the VPC we created above, and most importantly **select the private subnet** for this Glue connection. Continue and create the Glue connection for your data source.
12. Noting the public IP we allocated in Step 5, we can add it to our whitelist in Azure.
13. We're done! Now all AWS Glue jobs using the connection we created above will use the allocated public IP when communicating to external (outside of AWS) resources.