Configure Customer Managed Egress

Astro supports Customer Managed Egress for Dag Workloads on dedicated AWS clusters.

Customer Managed Egress for Dag Workloads lets you control egress to ensure compliance with security standards and regulations, and provides a data loss protection architecture to secure against unauthorized data transfer.

Enabling Customer Managed Egress through a Transit Gateway attachment between Astro and your corporate network allows you to manage and have full visibility into private and public data flows from your Astro Deployments and from Metrics Export configurations.

Prerequisites

• An existing dedicated AWS cluster. Create a dedicated cluster
• Organization Owner user permissions. See User permissions reference for more information.

Step 1: Create a resource share for Transit Gateway with Astro and submit Transit Gateway ID

1. In the Astro UI, click Organization Settings, then click Clusters. For an existing dedicated AWS cluster, click the cluster you want to edit. Then, navigate to the Customer Managed Egress for Dag Workloads section of the Cluster Details page.

2. Click Configure Customer Managed Egress…

3. Share your Transit Gateway with your Astro cluster account using AWS Resource Access Manager (AWS RAM). Your Astro cluster Account ID is provided to enter into AWS RAM.

4. Retrieve your AWS Transit Gateway ID from your AWS console.

5. Enter your AWS Transit Gateway ID into Transit Gateway ID.

Step 2: Astro accepts resource share and creates Transit Gateway attachment

Monitor the automatically generated Astro support ticket to accept the resource share and confirm Transit Gateway attachment is created. This activity is completed by Astronomer Support, so you don’t need to take action during this step.

Step 3: Enable Customer Managed Egress for Dag Workloads

1. Enable Customer Managed Egress for Dag Workloads.

2. Astro routes all public and private traffic to your Transit Gateway from your Astro Deployments and Private Network Egress mode is enabled.