From b827b5a61cceb848f7c95239098e9e38c7a5d05b Mon Sep 17 00:00:00 2001 From: atovpeko Date: Thu, 29 Jan 2026 15:44:23 +0200 Subject: [PATCH 01/11] draft --- .../images/azure-privatelink-architecture.svg | 60 ++++++ use-timescale/page-index/page-index.js | 6 + use-timescale/security/azure-privatelink.md | 193 ++++++++++++++++++ 3 files changed, 259 insertions(+) create mode 100644 static/images/azure-privatelink-architecture.svg create mode 100644 use-timescale/security/azure-privatelink.md diff --git a/static/images/azure-privatelink-architecture.svg b/static/images/azure-privatelink-architecture.svg new file mode 100644 index 0000000000..f4cb9cd9a0 --- /dev/null +++ b/static/images/azure-privatelink-architecture.svg @@ -0,0 +1,60 @@ + + + + + + + + Customer Azure infrastructure + + + + + Customer VNet + + + + Private endpoint + + + + + Tiger Cloud on Azure + + + + + Private Link + service + + + + Tiger Cloud VNet + + + + Tiger Cloud + service + + + + + + + + Azure Private Link + Connection + + +o + + + + + + + + + + + \ No newline at end of file diff --git a/use-timescale/page-index/page-index.js b/use-timescale/page-index/page-index.js index faaefdf736..702bd05bf0 100644 --- a/use-timescale/page-index/page-index.js +++ b/use-timescale/page-index/page-index.js @@ -694,6 +694,12 @@ module.exports = [ excerpt: "Secure your Tiger Cloud services with VPC peering and AWS PrivateLink", }, + { + title: "Azure Private Link", + href: "azure-privatelink", + excerpt: + "Secure your Tiger Cloud services with Azure Private Link", + }, { title: "IP allow list", href: "ip-allow-list", diff --git a/use-timescale/security/azure-privatelink.md b/use-timescale/security/azure-privatelink.md new file mode 100644 index 0000000000..004adb75a9 --- /dev/null +++ b/use-timescale/security/azure-privatelink.md @@ -0,0 +1,193 @@ +--- +title: Azure Private Link +excerpt: Azure Private Link ensures that your Tiger Cloud services are only accessible through your secured Azure infrastructure. Set up Private Link connections in Tiger Cloud Console +products: [cloud] +price_plans: [performance, scale, enterprise] +keywords: [PrivateLink, Azure, private endpoint, services, operations, security] +tags: [azure, security] +cloud_ui: + path: + - [services, :serviceId, operations, azure-privatelink] +--- + +# Secure your $CLOUD_LONG services with Azure Private Link + +Azure Private Link creates a private connection between your Azure Virtual Network and $CLOUD_LONG services, eliminating exposure to the public internet. Applications in your Azure VNet connect to a Private Endpoint with a private IP address, which links to a $CLOUD_LONG Private Link Service in a specific Azure region. Once bound to your $SERVICE_LONG, the database becomes accessible only through the Private Endpoint, providing enhanced security, reduced attack surface, and compliance with data isolation requirements. + +The setup involves authorizing your Azure subscription with $CLOUD_LONG, creating a Private Endpoint in your Azure VNet using a region-specific Private Link Service alias, and binding the endpoint to your $SERVICE_LONG. A single subscription authorization grants access to Private Link Services in all Azure regions, and you can create multiple Private Endpoints to the same region. + +![Azure Private Link architecture][azure-privatelink-architecture] + +## Prerequisites + +To set up Azure Private Link, you need: + +* An Azure subscription with appropriate permissions to create Private Endpoints and query network resources +* An existing Azure Virtual Network and subnet with private endpoint network policies disabled +* A $SERVICE_LONG in $CLOUD_LONG +* Azure CLI installed, or access to Azure Cloud Shell + +## Set up Azure Private Link connection + + + +1. **Get your Azure subscription ID** + + ```bash + az account show --query id -o tsv + ``` + +2. **In [$CONSOLE > Security > Azure Private Link][console-azure-privatelink], click `Authorize Subscription`** + +3. **Enter your Azure subscription ID and click `Authorize`** + + $CLOUD_LONG adds your subscription to the visibility list for all Azure region Private Link Services. + +4. **Note the Private Link Service alias for your chosen region** + + $CONSOLE displays the aliases you'll need to create Private Endpoints. These look like: + + ``` + /subscriptions/xxxxx/resourceGroups/xxxxx/providers/Microsoft.Network/privateLinkServices/tiger-eastus + ``` + + Choose the alias for the region closest to your Azure resources for optimal performance. + +5. **Create the Private Endpoint using the alias from the previous step** + + Replace `` with the alias for your chosen region: + + ```bash + az network private-endpoint create \ + --name tiger-private-endpoint \ + --resource-group \ + --vnet-name \ + --subnet \ + --private-connection-resource-id \ + --connection-name tiger-connection \ + --manual-request true \ + --location + ``` + +6. **Query the Private Endpoint IP address** + + ```bash + az network private-endpoint show \ + --name tiger-private-endpoint \ + --resource-group \ + --query 'customDnsConfigs[0].ipAddresses[0]' \ + --output tsv + ``` + + Save this IP address for the next step. + +7. **In [$CONSOLE > Security > Azure Private Link][console-azure-privatelink], click `Sync Connections`** + + $CLOUD_LONG automatically approves connections from authorized subscriptions. Your connection status changes from "Pending" to "Approved". + +8. **Click on your connection to view details** + +9. **Enter the Private Endpoint IP address from step 6 and click `Update`** + +10. **Select the $SERVICE_LONG you want to connect to this Private Endpoint** + +11. **Click `Create Binding`** + + $CLOUD_LONG performs several backend operations: + * Disables public internet access to your $SERVICE_LONG + * Configures routing based on your Private Endpoint IP + * Updates the service certificate + * Generates a DNS record + * Returns a hostname for your connection + +12. **Copy the hostname provided** + + Use this hostname to connect to your database: + + ``` + postgresql://username:password@your-service.eastus.tiger.cloud:5432/database + ``` + +Your $SERVICE_LONG is now accessible only through your Azure Private Endpoint. + + + +## Test the connection + +After setting up Private Link, verify that the connection works. + + + +1. **From a resource inside your Azure VNet** (such as a VM or Azure App Service), test the connection: + + ```bash + psql "postgresql://username:password@your-service.eastus.tiger.cloud:5432/database" + ``` + +2. **Verify that the connection succeeds** + +3. **Try connecting from outside your VNet** (such as your local machine) + + The connection should fail, confirming that public access is disabled. + + + +## Manage Private Link connections + +### View connection status + +In [$CONSOLE > Security > Azure Private Link][console-azure-privatelink], you can view: +* All authorized Azure subscriptions +* Active Private Endpoint connections +* Connection status (Pending, Approved, Rejected) +* Service bindings + +### Remove a Private Link connection + +To disconnect a $SERVICE_LONG from a Private Endpoint: + + + +1. **In [$CONSOLE > Security > Azure Private Link][console-azure-privatelink], select your connection** +2. **Click the service binding you want to remove** +3. **Click `Remove Binding`** + +The $SERVICE_LONG returns to public access (if no other Private Link connection is active). + + + +### Delete a Private Endpoint in Azure + +If you delete a Private Endpoint in Azure, the connection becomes broken. Update your $CONSOLE to reflect this change: + + + +1. **Delete the Private Endpoint in Azure** + + ```bash + az network private-endpoint delete \ + --name tiger-private-endpoint \ + --resource-group tiger-privatelink-rg + ``` + +2. **In [$CONSOLE > Security > Azure Private Link][console-azure-privatelink], click `Sync Connections`** + + $CLOUD_LONG detects the removed connection and updates the status. + + + +## Regional considerations + +* **Cross-region connectivity**: Private Endpoints can connect to Private Link Services in different Azure regions, but for best performance, use the same region +* **Multiple regions**: You can create Private Endpoints in multiple regions connecting to the same $CLOUD_LONG region, or to different $CLOUD_LONG regions +* **Available regions**: Private Link Services are available in all [$CLOUD_LONG supported Azure regions][regions] + + + +After attaching a $SERVICE_SHORT to a Private Endpoint, it is no longer accessible from the public internet. Make sure all your applications are configured to connect through the Private Endpoint before creating the binding. + + + +[azure-privatelink-architecture]: /static/images/azure-privatelink-architecture.svg +[console-azure-privatelink]: https://console.cloud.timescale.com/dashboard/azure-privatelink +[regions]: /about/:currentVersion:/supported-platforms/#available-regions \ No newline at end of file From 0761cdfd3e758cbe5058ad6b988178355fb5dd93 Mon Sep 17 00:00:00 2001 From: atovpeko Date: Fri, 30 Jan 2026 15:34:25 +0200 Subject: [PATCH 02/11] draft --- use-timescale/security/azure-privatelink.md | 26 +++++++++------------ 1 file changed, 11 insertions(+), 15 deletions(-) diff --git a/use-timescale/security/azure-privatelink.md b/use-timescale/security/azure-privatelink.md index 004adb75a9..0071a588c2 100644 --- a/use-timescale/security/azure-privatelink.md +++ b/use-timescale/security/azure-privatelink.md @@ -10,22 +10,20 @@ cloud_ui: - [services, :serviceId, operations, azure-privatelink] --- -# Secure your $CLOUD_LONG services with Azure Private Link +import IntegrationPrereqsCloud from "versionContent/_partials/_integration-prereqs-cloud-only.mdx"; -Azure Private Link creates a private connection between your Azure Virtual Network and $CLOUD_LONG services, eliminating exposure to the public internet. Applications in your Azure VNet connect to a Private Endpoint with a private IP address, which links to a $CLOUD_LONG Private Link Service in a specific Azure region. Once bound to your $SERVICE_LONG, the database becomes accessible only through the Private Endpoint, providing enhanced security, reduced attack surface, and compliance with data isolation requirements. +# Secure your $CLOUD_LONG services with Azure Private Link -The setup involves authorizing your Azure subscription with $CLOUD_LONG, creating a Private Endpoint in your Azure VNet using a region-specific Private Link Service alias, and binding the endpoint to your $SERVICE_LONG. A single subscription authorization grants access to Private Link Services in all Azure regions, and you can create multiple Private Endpoints to the same region. +Azure Private Link creates a private connection between your Azure Virtual Network and $CLOUD_LONG services, eliminating exposure to the public internet. Applications in your Azure VNet connect to a Private Endpoint with a private IP address, which links to $CLOUD_LONG. Once connected, your $SERVICE_SHORTs become accessible only through the Private Endpoint, providing enhanced security, reduced attack surface, and compliance with data isolation requirements. ![Azure Private Link architecture][azure-privatelink-architecture] ## Prerequisites -To set up Azure Private Link, you need: + -* An Azure subscription with appropriate permissions to create Private Endpoints and query network resources -* An existing Azure Virtual Network and subnet with private endpoint network policies disabled -* A $SERVICE_LONG in $CLOUD_LONG -* Azure CLI installed, or access to Azure Cloud Shell +* Get an Azure subscription with permissions to create Private Endpoints and query network resources +* Create an Azure Virtual Network with a subnet with private endpoint network policies disabled ## Set up Azure Private Link connection @@ -33,17 +31,15 @@ To set up Azure Private Link, you need: 1. **Get your Azure subscription ID** - ```bash - az account show --query id -o tsv - ``` + In Azure Portal, search for `Subscriptions` and copy the ID of the subscription you are going to use. -2. **In [$CONSOLE > Security > Azure Private Link][console-azure-privatelink], click `Authorize Subscription`** +1. **In [$CONSOLE > `Security` > `Private Link`][console-azure-privatelink], click `Authorize Subscription`** -3. **Enter your Azure subscription ID and click `Authorize`** +1. **Enter your Azure subscription ID and click `Authorize`** $CLOUD_LONG adds your subscription to the visibility list for all Azure region Private Link Services. -4. **Note the Private Link Service alias for your chosen region** +1. **Note the Private Link Service alias for your chosen region** $CONSOLE displays the aliases you'll need to create Private Endpoints. These look like: @@ -53,7 +49,7 @@ To set up Azure Private Link, you need: Choose the alias for the region closest to your Azure resources for optimal performance. -5. **Create the Private Endpoint using the alias from the previous step** +1. **Create the Private Endpoint using the alias from the previous step** Replace `` with the alias for your chosen region: From af5a10b43a2527de84cb7b4265b2907b259f8067 Mon Sep 17 00:00:00 2001 From: atovpeko Date: Mon, 2 Feb 2026 13:07:14 +0200 Subject: [PATCH 03/11] draft --- _partials/_azure-features.md | 89 ++++----- about/feature-comparison.md | 169 ++++++++--------- integrations/microsoft-azure.md | 19 +- .../images/azure-privatelink-architecture.svg | 60 ------ use-timescale/security/azure-privatelink.md | 171 +----------------- 5 files changed, 149 insertions(+), 359 deletions(-) delete mode 100644 static/images/azure-privatelink-architecture.svg diff --git a/_partials/_azure-features.md b/_partials/_azure-features.md index c265674f84..48fb7a8409 100644 --- a/_partials/_azure-features.md +++ b/_partials/_azure-features.md @@ -9,51 +9,52 @@ The available $PRICING_PLANs are: The features included in each [$PRICING_PLAN][pricing-plans] are: -| Feature | Free | $PERFORMANCE | $SCALE | $ENTERPRISE | -|---------------------------------------------------------------|-----------------------------------|----------------------------------------|------------------------------------------------|--------------------------------------------------| -| **Compute and storage** | | | | | -| Number of $SERVICE_SHORTs | Up to 2 free services | Up to 2 free and 4 standard services | Up to 2 free and and unlimited standard services | Up to 2 free and and unlimited standard services | -| CPU limit per $SERVICE_SHORT | Shared | Up to 8 CPU | Up to 32 CPU | Up to 64 CPU | -| Memory limit per $SERVICE_SHORT | Shared | Up to 32 GB | Up to 128 GB | Up to 256 GB | -| Storage limit per $SERVICE_SHORT | 750 MB | Up to 16 TB | Up to 16 TB | Up to 16 TB | -| Independently scale compute and storage | | Standard services only | Standard services only | Standard services only | -| **Data services and workloads** | | | | -| Relational | ✓ | ✓ | ✓ | ✓ | -| Time-series | ✓ | ✓ | ✓ | ✓ | -| Vector search | ✓ | ✓ | ✓ | ✓ | -| AI workflows (coming soon) | ✓ | ✓ | ✓ | ✓ | -| Cloud SQL editor | 3 seats | 3 seats | 10 seats | 20 seats | -| Charts | ✓ | ✓ | ✓ | ✓ | -| Dashboards | | 2 | Unlimited | Unlimited | -| **Storage and performance** | | | | | -| IOPS | Shared | 3,000 - 5,000 | 5,000 - 8,000 | 5,000 - 8,000 | -| Bandwidth (autoscales) | Shared | 125 - 250 Mbps | 250 - 500 Mbps | Up to 500 mbps | -| I/O boost | | | Add-on:
Up to 16K IOPS, 1000 Mbps BW | Add-on:
Up to 16K IOPS, 1000 Mbps BW | -| **Availability and monitoring** | | | | | +| Feature | Free | $PERFORMANCE | $SCALE | $ENTERPRISE | +|--------------------------------------------------------------|-----------------------------------|----------------------------------------|------------------------------------------------|--------------------------------------------------| +| **Compute and storage** | | | | | +| Number of $SERVICE_SHORTs | Up to 2 free services | Up to 2 free and 4 standard services | Up to 2 free and and unlimited standard services | Up to 2 free and and unlimited standard services | +| CPU limit per $SERVICE_SHORT | Shared | Up to 8 CPU | Up to 32 CPU | Up to 64 CPU | +| Memory limit per $SERVICE_SHORT | Shared | Up to 32 GB | Up to 128 GB | Up to 256 GB | +| Storage limit per $SERVICE_SHORT | 750 MB | Up to 16 TB | Up to 16 TB | Up to 16 TB | +| Independently scale compute and storage | | Standard services only | Standard services only | Standard services only | +| **Data services and workloads** | | | | +| Relational | ✓ | ✓ | ✓ | ✓ | +| Time-series | ✓ | ✓ | ✓ | ✓ | +| Vector search | ✓ | ✓ | ✓ | ✓ | +| AI workflows (coming soon) | ✓ | ✓ | ✓ | ✓ | +| Cloud SQL editor | 3 seats | 3 seats | 10 seats | 20 seats | +| Charts | ✓ | ✓ | ✓ | ✓ | +| Dashboards | | 2 | Unlimited | Unlimited | +| **Storage and performance** | | | | | +| IOPS | Shared | 3,000 - 5,000 | 5,000 - 8,000 | 5,000 - 8,000 | +| Bandwidth (autoscales) | Shared | 125 - 250 Mbps | 250 - 500 Mbps | Up to 500 mbps | +| I/O boost | | | Add-on:
Up to 16K IOPS, 1000 Mbps BW | Add-on:
Up to 16K IOPS, 1000 Mbps BW | +| **Availability and monitoring** | | | | | | High-availability replicas
(Automated multi-AZ failover) | | ✓ | ✓ | ✓ | -| Read replicas | | | ✓ | ✓ | -| Backup reports | | | 14 days | 14 days | -| Point-in-time recovery and forking | 1 day | 3 days | 14 days | 14 days | -| Performance insights | Limited | ✓ | ✓ | ✓ | -| Metrics and log exporters | | | ✓ | ✓ | -| **Security and compliance** | | | | | -| Role-based access | ✓ | ✓ | ✓ | ✓ | -| End-to-end encryption | ✓ | ✓ | ✓ | ✓ | -| [HIPAA compliance][hipaa-compliance] | | | | ✓ | -| IP address allow list | 1 list with up to 10 IP addresses | 1 list with up to 10 IP addresses | Up to 10 lists with up to 10 IP addresses each | Up to 10 lists with up to 100 IP addresses each | -| Multi-factor authentication | ✓ | ✓ | ✓ | ✓ | -| Federated authentication (SAML) | | | | ✓ | -| SOC 2 Type 2 report | | | ✓ | ✓ | -| Penetration testing report | | | | ✓ | -| Security questionnaire and review | | | | ✓ | -| Pay by invoice | | Available at minimum spend | Available at minimum spend | ✓ | -| [Uptime SLAs][commercial-sla] | | Standard | Standard | Enterprise | -| **Support and technical services** | | | | | -| Community support | ✓ | ✓ | ✓ | ✓ | -| Email support | | ✓ | ✓ | ✓ | -| Production support | | Add-on | Add-on | ✓ | -| Named account manager | | | | ✓ | -| JOIN services (Jumpstart Onboarding and INtegration) | | | Available at minimum spend | ✓ | +| Read replicas | | | ✓ | ✓ | +| Backup reports | | | 14 days | 14 days | +| Point-in-time recovery and forking | 1 day | 3 days | 14 days | 14 days | +| Performance insights | Limited | ✓ | ✓ | ✓ | +| Metrics and log exporters | | | ✓ | ✓ | +| **Security and compliance** | | | | | +| Role-based access | ✓ | ✓ | ✓ | ✓ | +| End-to-end encryption | ✓ | ✓ | ✓ | ✓ | +| Azure Private Link | | ||| +| [HIPAA compliance][hipaa-compliance] | | | | ✓ | +| IP address allow list | 1 list with up to 10 IP addresses | 1 list with up to 10 IP addresses | Up to 10 lists with up to 10 IP addresses each | Up to 10 lists with up to 100 IP addresses each | +| Multi-factor authentication | ✓ | ✓ | ✓ | ✓ | +| Federated authentication (SAML) | | | | ✓ | +| SOC 2 Type 2 report | | | ✓ | ✓ | +| Penetration testing report | | | | ✓ | +| Security questionnaire and review | | | | ✓ | +| Pay by invoice | | Available at minimum spend | Available at minimum spend | ✓ | +| [Uptime SLAs][commercial-sla] | | Standard | Standard | Enterprise | +| **Support and technical services** | | | | | +| Community support | ✓ | ✓ | ✓ | ✓ | +| Email support | | ✓ | ✓ | ✓ | +| Production support | | Add-on | Add-on | ✓ | +| Named account manager | | | | ✓ | +| JOIN services (Jumpstart Onboarding and INtegration) | | | Available at minimum spend | ✓ | For a personalized quote, [get in touch with $COMPANY][contact-company]. diff --git a/about/feature-comparison.md b/about/feature-comparison.md index e2fad794cf..399cd8a3d8 100644 --- a/about/feature-comparison.md +++ b/about/feature-comparison.md @@ -9,90 +9,91 @@ keywords: [TimescaleDB, Tiger Cloud] The following table compares the features available in $CLOUD_LONG and self-hosted $TDB_COMMUNITY. -| Feature | $CLOUD_LONG on AWS | $CLOUD_LONG on Azure | self-hosted $TIMESCALE_DB | -|---------------------------------------------------------------------------------------------------------------------|-------------------------------------------|-------------------------------------|---------------------------------------------| -| **Best-in-сlass $PG performance** | | | | -| Automatic partitioning via hypertables for efficient indexes and faster ingest | ✓ | ✓ | ✓ | -| Continuous aggregates | ✓ | ✓ | ✓ | -| Time/partition-oriented constraint exclusion for faster queries | ✓ | ✓ | ✓ | -| Skip scans, ordered appends, custom optimizations for faster `LIMIT` and `DISTINCT` queries | ✓ | ✓ | ✓ | -| Columnar storage for accelerated scans | ✓ | ✓ | ✓ | -| Vectorized query execution (SIMD) | ✓ | ✓ | ✓ | -| Specialized vector indexes for AI applications | ✓ | ✓ | ✓ | -| $PG_CONNECTOR_CAP | ✓ | ✓ | Manual | -| $S3_CONNECTOR_CAP | ✓ | ✗ | ✗ | -| Source Apache Kafka connector | ✓ | ✗ | ✗ | -| $LAKE_LONG destination connector from $CLOUD_LONG to Iceberg-backed S3 Tables | ✓ | ✗ | ✗ | -| In-Console CSV, Parquet, and text file imports | ✓ | ✗ | ✗ | -| **Flexible analysis with full SQL** | | | | -| Complete $PG ecosystem including all $PG features, connectors, and third-party drivers | ✓ | ✓ | ✓ | -| Cross-table JOINs for time-series and events tables with relational tables | ✓ | ✓ | ✓ | -| Rich timestamp and timezone support | ✓ | ✓ | ✓ | -| Flexible time-bucketing for time-oriented analysis | ✓ | ✓ | ✓ | -| Advanced hyperfunctions including interpolation, approximation, and visualization functions | ✓ | ✓ | ✓ | -| Geospatial and vector data types | ✓ | ✓ | ✓ | -| **Automated data management** | | | | -| Native compression (up to 98% storage savings) | ✓ | ✓ | ✓ | -| Columnar storage format with fast scans | ✓ | ✓ | ✓ | -| Data retention policies | ✓ | ✓ | ✓ | -| Data tiering with automated policies | ✓ | ✗ | ✗ | -| Data reordering for efficient disk scans | ✓ | ✓ | ✓ | -| Data downsampling for efficient historical analysis | ✓ | ✓ | ✓ | -| Background job scheduler and user-defined jobs | ✓ | ✓ | ✓ | -| **Enterprise scalability** | | | | -| Disaggregated compute and storage | ✓ | ✓ | Manual | -| Dynamic compute resizing | ✓ | ✓ | ✗ | -| Dynamic disk storage with usage-based pricing | ✓ | ✓ | ✗ | -| Dynamic I/O provisioning for high-read/ high-write performance | ✓ | ✓ | Manual | -| Low-cost storage with infinite capacity on S3 | ✓ | ✗ | ✗ | -| Transparent queries across high-performance and low-cost tiers | ✓ | ✗ | ✗ | -| Read replicas with load balancing for seamless read scaling | ✓ | ✓ | Manual | -| Connection pooling for connection scaling | ✓ | ✓ | Manual | -| Automated resource-aware parameter tuning | ✓ | ✓ | ✗ | -| Terraform for infrastructure-as-code control | ✓ | ✓ | ✗ | -| **High availability and reliability** | | | | -| Multi-AZ deployments for high availability | ✓ | ✓ | Manual | -| Continuous incremental backup and automated restore | ✓ | ✓ | Manual | -| Cross-region backup | ✓ | 🔜 | ✗ | -| Point-in-time recovery and branching | ✓ | ✓ | Manual | -| Regular database and disk snapshots to enable fast restore | ✓ | ✓ | ✗ | -| Rapid recovery for all services by fast database restart and remote disk remount | ✓ | ✓ | ✗ | -| Memory guard protections to avoid database out-of-memory crashes | ✓ | ✓ | ✗ | -| Decoupled control/data planes for greater resilience | ✓ | ✓ | ✗ | -| Commercial SLAs | ✓ | ✓ | ✗ | -| **Automated upgrades and software patching** | | | | -| Automated upgrades during maintenance windows | ✓ | ✓ | ✗ | -| Phased, zero-downtime $TIMESCALE_DB and $PG minor upgrades | ✓ | ✓ | ✗ | -| $PG major version upgrades with forking workflow and disk snapshots to minimize downtime | ✓ | ✓ | ✗ | -| HA-replica-aware coordinated upgrades | ✓ | ✓ | ✗ | -| Fleet-wide version and stability monitoring with staged roll-out/roll-back upgrades | ✓ | ✓ | ✗ | -| **Security and compliance** | | | | -| SOC 2 Type 2, GDPR, HIPAA certified compliance | ✓ | ✓ | ✗ | -| Data encryption at rest (both disk and backup) | ✓ | ✓ | Manual | -| Data encryption in transit | ✓ | ✓ | Manual | -| Database SSL with fully verifiable certificate chains | ✓ | ✓ | ✗ | -| Control plane role-based access control | ✓ | ✓ | ✗ | -| Database role-based access control | ✓ | ✓ | ✓ | -| Multi-factor authentication | ✓ | ✓ | ✗ | -| Corporate SSO and SAML | ✓ | ✓ | ✗ | -| VPC peering | ✓ | ✗ | ✗ | -| AWS Transit Gateway | ✓ | ✗ | ✗ | -| Layered database "privilege escalation" protections | ✓ | ✓ | ✗ | -| Secure SDLC practices and vulnerability scanning, third-party pen testing | ✓ | ✓ | ✗ | -| **Deep observability** | | | | -| Operational database visibility to understand performance, uncover regressions, optimize performance | ✓ | ✓ | ✗ | -| Automated query analysis and statistics | ✓ | ✓ | ✗ | -| Per-query drill-downs into execution times, row results, plans, memory buffer management, cache performance | ✓ | ✓ | ✗ | -| In-Console metric visualization and system logs | ✓ | ✓ | ✗ | -| Exporters to AWS CloudWatch, Prometheus, Datadog | ✓ | ✗ | ✗ | -| Connection monitoring | ✓ | ✓ | Manual | -| Connection management | ✓ | ✓ | Manual | -| **Production-grade support and operations** | | | | -| 24/7 follow-the-sun support with global support team across APAC, EMEA, and Americas | ✓ | ✓ | [Contact sales][contact-sales] | -| Production support (severity 1) | ✓ | ✓ | [Contact sales][contact-sales] | -| Architectural reviews, data modeling, and query optimization and assistance, feature testing, and migration support | ✓ | ✓ | [Contact sales][contact-sales] | -| 24/7 operational monitoring and control | ✓ | ✓ | [Contact sales][contact-sales] | -| 98%+ customer satisfaction (CSAT scores) | ✓ | ✓ | [Contact sales][contact-sales] | +| Feature | $CLOUD_LONG on AWS | $CLOUD_LONG on Azure | Self-hosted $TDB_COMMUNITY | +|---------------------------------------------------------------------------------------------------------------------|-------------------------------------------|------------------------------------|------------------------------------| +| **Best-in-сlass $PG performance** | | | | +| Automatic partitioning via hypertables for efficient indexes and faster ingest | ✓ | ✓ | ✓ | +| Continuous aggregates | ✓ | ✓ | ✓ | +| Time/partition-oriented constraint exclusion for faster queries | ✓ | ✓ | ✓ | +| Skip scans, ordered appends, custom optimizations for faster `LIMIT` and `DISTINCT` queries | ✓ | ✓ | ✓ | +| Columnar storage for accelerated scans | ✓ | ✓ | ✓ | +| Vectorized query execution (SIMD) | ✓ | ✓ | ✓ | +| Specialized vector indexes for AI applications | ✓ | ✓ | ✓ | +| $PG_CONNECTOR_CAP | ✓ | ✓ | Manual | +| $S3_CONNECTOR_CAP | ✓ | ✗ | ✗ | +| Source Apache Kafka connector | ✓ | ✗ | ✗ | +| $LAKE_LONG destination connector from $CLOUD_LONG to Iceberg-backed S3 Tables | ✓ | ✗ | ✗ | +| In-Console CSV, Parquet, and text file imports | ✓ | ✗ | ✗ | +| **Flexible analysis with full SQL** | | | | +| Complete $PG ecosystem including all $PG features, connectors, and third-party drivers | ✓ | ✓ | ✓ | +| Cross-table JOINs for time-series and events tables with relational tables | ✓ | ✓ | ✓ | +| Rich timestamp and timezone support | ✓ | ✓ | ✓ | +| Flexible time-bucketing for time-oriented analysis | ✓ | ✓ | ✓ | +| Advanced hyperfunctions including interpolation, approximation, and visualization functions | ✓ | ✓ | ✓ | +| Geospatial and vector data types | ✓ | ✓ | ✓ | +| **Automated data management** | | | | +| Native compression (up to 98% storage savings) | ✓ | ✓ | ✓ | +| Columnar storage format with fast scans | ✓ | ✓ | ✓ | +| Data retention policies | ✓ | ✓ | ✓ | +| Data tiering with automated policies | ✓ | ✗ | ✗ | +| Data reordering for efficient disk scans | ✓ | ✓ | ✓ | +| Data downsampling for efficient historical analysis | ✓ | ✓ | ✓ | +| Background job scheduler and user-defined jobs | ✓ | ✓ | ✓ | +| **Enterprise scalability** | | | | +| Disaggregated compute and storage | ✓ | ✓ | Manual | +| Dynamic compute resizing | ✓ | ✓ | ✗ | +| Dynamic disk storage with usage-based pricing | ✓ | ✓ | ✗ | +| Dynamic I/O provisioning for high-read/ high-write performance | ✓ | ✓ | Manual | +| Low-cost storage with infinite capacity on S3 | ✓ | ✗ | ✗ | +| Transparent queries across high-performance and low-cost tiers | ✓ | ✗ | ✗ | +| Read replicas with load balancing for seamless read scaling | ✓ | ✓ | Manual | +| Connection pooling for connection scaling | ✓ | ✓ | Manual | +| Automated resource-aware parameter tuning | ✓ | ✓ | ✗ | +| Terraform for infrastructure-as-code control | ✓ | ✓ | ✗ | +| **High availability and reliability** | | | | +| Multi-AZ deployments for high availability | ✓ | ✓ | Manual | +| Continuous incremental backup and automated restore | ✓ | ✓ | Manual | +| Cross-region backup | ✓ | Coming soon | ✗ | +| Point-in-time recovery and branching | ✓ | ✓ | Manual | +| Regular database and disk snapshots to enable fast restore | ✓ | ✓ | ✗ | +| Rapid recovery for all services by fast database restart and remote disk remount | ✓ | ✓ | ✗ | +| Memory guard protections to avoid database out-of-memory crashes | ✓ | ✓ | ✗ | +| Decoupled control/data planes for greater resilience | ✓ | ✓ | ✗ | +| Commercial SLAs | ✓ | ✓ | ✗ | +| **Automated upgrades and software patching** | | | | +| Automated upgrades during maintenance windows | ✓ | ✓ | ✗ | +| Phased, zero-downtime $TIMESCALE_DB and $PG minor upgrades | ✓ | ✓ | ✗ | +| $PG major version upgrades with forking workflow and disk snapshots to minimize downtime | ✓ | ✓ | ✗ | +| HA-replica-aware coordinated upgrades | ✓ | ✓ | ✗ | +| Fleet-wide version and stability monitoring with staged roll-out/roll-back upgrades | ✓ | ✓ | ✗ | +| **Security and compliance** | | | | +| SOC 2 Type 2, GDPR, HIPAA certified compliance | ✓ | ✓ | ✗ | +| Data encryption at rest (both disk and backup) | ✓ | ✓ | Manual | +| Data encryption in transit | ✓ | ✓ | Manual | +| Database SSL with fully verifiable certificate chains | ✓ | ✓ | ✗ | +| Control plane role-based access control | ✓ | ✓ | ✗ | +| Database role-based access control | ✓ | ✓ | ✓ | +| Multi-factor authentication | ✓ | ✓ | ✗ | +| Corporate SSO and SAML | ✓ | ✓ | ✗ | +| VPC peering | ✓ | ✗ | ✗ | +| Azure Private Link | ✗ | ✓ | ✗ | +| AWS Transit Gateway | ✓ | ✗ | ✗ | +| Layered database "privilege escalation" protections | ✓ | ✓ | ✗ | +| Secure SDLC practices and vulnerability scanning, third-party pen testing | ✓ | ✓ | ✗ | +| **Deep observability** | | | | +| Operational database visibility to understand performance, uncover regressions, optimize performance | ✓ | ✓ | ✗ | +| Automated query analysis and statistics | ✓ | ✓ | ✗ | +| Per-query drill-downs into execution times, row results, plans, memory buffer management, cache performance | ✓ | ✓ | ✗ | +| In-Console metric visualization and system logs | ✓ | ✓ | ✗ | +| Exporters to AWS CloudWatch, Prometheus, Datadog | ✓ | ✗ | ✗ | +| Connection monitoring | ✓ | ✓ | Manual | +| Connection management | ✓ | ✓ | Manual | +| **Production-grade support and operations** | | | | +| 24/7 follow-the-sun support with global support team across APAC, EMEA, and Americas | ✓ | ✓ | [Contact sales][contact-sales] | +| Production support (severity 1) | ✓ | ✓ | [Contact sales][contact-sales] | +| Architectural reviews, data modeling, and query optimization and assistance, feature testing, and migration support | ✓ | ✓ | [Contact sales][contact-sales] | +| 24/7 operational monitoring and control | ✓ | ✓ | [Contact sales][contact-sales] | +| 98%+ customer satisfaction (CSAT scores) | ✓ | ✓ | [Contact sales][contact-sales] | [contact-sales]: mailto:sales@tigerdata.com diff --git a/integrations/microsoft-azure.md b/integrations/microsoft-azure.md index 9c05fb69ff..0d9b585243 100644 --- a/integrations/microsoft-azure.md +++ b/integrations/microsoft-azure.md @@ -8,21 +8,24 @@ keywords: [Azure, integrations] import IntegrationPrereqsCloud from "versionContent/_partials/_integration-prereqs-cloud-only.mdx"; import TransitGateway from "versionContent/_partials/_transit-gateway.mdx"; -import NotSupportedAzure from "versionContent/_partials/_not-supported-for-azure.mdx"; +import AzurePrivateLink from "versionContent/_partials/_azure-privatelink.mdx"; # Integrate Microsoft Azure with $CLOUD_LONG [Microsoft Azure][azure] is a cloud computing platform and services suite, offering infrastructure, AI, analytics, security, and developer tools to help businesses build, deploy, and manage applications. -This page explains how to integrate your Microsoft Azure infrastructure with $CLOUD_LONG using [AWS Transit Gateway][aws-transit-gateway]. + + + + +This page explains how to integrate your Microsoft Azure infrastructure with $CLOUD_LONG on AWS using [AWS Transit Gateway][aws-transit-gateway]. ## Prerequisites - Set up [AWS Transit Gateway][gtw-setup]. - ## Connect your Microsoft Azure infrastructure to your $SERVICE_LONGs @@ -40,6 +43,16 @@ To connect to $CLOUD_LONG: You have successfully integrated your Microsoft Azure infrastructure with $CLOUD_LONG. + + + + + + + + + + [aws-transit-gateway]: https://aws.amazon.com/transit-gateway/ [azure-aws]: https://aws.amazon.com/blogs/modernizing-with-aws/designing-private-network-connectivity-aws-azure/ [azure]: https://azure.microsoft.com/en-gb/ diff --git a/static/images/azure-privatelink-architecture.svg b/static/images/azure-privatelink-architecture.svg deleted file mode 100644 index f4cb9cd9a0..0000000000 --- a/static/images/azure-privatelink-architecture.svg +++ /dev/null @@ -1,60 +0,0 @@ - - - - - - - - Customer Azure infrastructure - - - - - Customer VNet - - - - Private endpoint - - - - - Tiger Cloud on Azure - - - - - Private Link - service - - - - Tiger Cloud VNet - - - - Tiger Cloud - service - - - - - - - - Azure Private Link - Connection - - -o - - - - - - - - - - - \ No newline at end of file diff --git a/use-timescale/security/azure-privatelink.md b/use-timescale/security/azure-privatelink.md index 0071a588c2..57d18189e1 100644 --- a/use-timescale/security/azure-privatelink.md +++ b/use-timescale/security/azure-privatelink.md @@ -11,6 +11,7 @@ cloud_ui: --- import IntegrationPrereqsCloud from "versionContent/_partials/_integration-prereqs-cloud-only.mdx"; +import AzurePrivateLink from "versionContent/_partials/_azure-privatelink.mdx"; # Secure your $CLOUD_LONG services with Azure Private Link @@ -18,172 +19,6 @@ Azure Private Link creates a private connection between your Azure Virtual Netwo ![Azure Private Link architecture][azure-privatelink-architecture] -## Prerequisites + - - -* Get an Azure subscription with permissions to create Private Endpoints and query network resources -* Create an Azure Virtual Network with a subnet with private endpoint network policies disabled - -## Set up Azure Private Link connection - - - -1. **Get your Azure subscription ID** - - In Azure Portal, search for `Subscriptions` and copy the ID of the subscription you are going to use. - -1. **In [$CONSOLE > `Security` > `Private Link`][console-azure-privatelink], click `Authorize Subscription`** - -1. **Enter your Azure subscription ID and click `Authorize`** - - $CLOUD_LONG adds your subscription to the visibility list for all Azure region Private Link Services. - -1. **Note the Private Link Service alias for your chosen region** - - $CONSOLE displays the aliases you'll need to create Private Endpoints. These look like: - - ``` - /subscriptions/xxxxx/resourceGroups/xxxxx/providers/Microsoft.Network/privateLinkServices/tiger-eastus - ``` - - Choose the alias for the region closest to your Azure resources for optimal performance. - -1. **Create the Private Endpoint using the alias from the previous step** - - Replace `` with the alias for your chosen region: - - ```bash - az network private-endpoint create \ - --name tiger-private-endpoint \ - --resource-group \ - --vnet-name \ - --subnet \ - --private-connection-resource-id \ - --connection-name tiger-connection \ - --manual-request true \ - --location - ``` - -6. **Query the Private Endpoint IP address** - - ```bash - az network private-endpoint show \ - --name tiger-private-endpoint \ - --resource-group \ - --query 'customDnsConfigs[0].ipAddresses[0]' \ - --output tsv - ``` - - Save this IP address for the next step. - -7. **In [$CONSOLE > Security > Azure Private Link][console-azure-privatelink], click `Sync Connections`** - - $CLOUD_LONG automatically approves connections from authorized subscriptions. Your connection status changes from "Pending" to "Approved". - -8. **Click on your connection to view details** - -9. **Enter the Private Endpoint IP address from step 6 and click `Update`** - -10. **Select the $SERVICE_LONG you want to connect to this Private Endpoint** - -11. **Click `Create Binding`** - - $CLOUD_LONG performs several backend operations: - * Disables public internet access to your $SERVICE_LONG - * Configures routing based on your Private Endpoint IP - * Updates the service certificate - * Generates a DNS record - * Returns a hostname for your connection - -12. **Copy the hostname provided** - - Use this hostname to connect to your database: - - ``` - postgresql://username:password@your-service.eastus.tiger.cloud:5432/database - ``` - -Your $SERVICE_LONG is now accessible only through your Azure Private Endpoint. - - - -## Test the connection - -After setting up Private Link, verify that the connection works. - - - -1. **From a resource inside your Azure VNet** (such as a VM or Azure App Service), test the connection: - - ```bash - psql "postgresql://username:password@your-service.eastus.tiger.cloud:5432/database" - ``` - -2. **Verify that the connection succeeds** - -3. **Try connecting from outside your VNet** (such as your local machine) - - The connection should fail, confirming that public access is disabled. - - - -## Manage Private Link connections - -### View connection status - -In [$CONSOLE > Security > Azure Private Link][console-azure-privatelink], you can view: -* All authorized Azure subscriptions -* Active Private Endpoint connections -* Connection status (Pending, Approved, Rejected) -* Service bindings - -### Remove a Private Link connection - -To disconnect a $SERVICE_LONG from a Private Endpoint: - - - -1. **In [$CONSOLE > Security > Azure Private Link][console-azure-privatelink], select your connection** -2. **Click the service binding you want to remove** -3. **Click `Remove Binding`** - -The $SERVICE_LONG returns to public access (if no other Private Link connection is active). - - - -### Delete a Private Endpoint in Azure - -If you delete a Private Endpoint in Azure, the connection becomes broken. Update your $CONSOLE to reflect this change: - - - -1. **Delete the Private Endpoint in Azure** - - ```bash - az network private-endpoint delete \ - --name tiger-private-endpoint \ - --resource-group tiger-privatelink-rg - ``` - -2. **In [$CONSOLE > Security > Azure Private Link][console-azure-privatelink], click `Sync Connections`** - - $CLOUD_LONG detects the removed connection and updates the status. - - - -## Regional considerations - -* **Cross-region connectivity**: Private Endpoints can connect to Private Link Services in different Azure regions, but for best performance, use the same region -* **Multiple regions**: You can create Private Endpoints in multiple regions connecting to the same $CLOUD_LONG region, or to different $CLOUD_LONG regions -* **Available regions**: Private Link Services are available in all [$CLOUD_LONG supported Azure regions][regions] - - - -After attaching a $SERVICE_SHORT to a Private Endpoint, it is no longer accessible from the public internet. Make sure all your applications are configured to connect through the Private Endpoint before creating the binding. - - - -[azure-privatelink-architecture]: /static/images/azure-privatelink-architecture.svg -[console-azure-privatelink]: https://console.cloud.timescale.com/dashboard/azure-privatelink -[regions]: /about/:currentVersion:/supported-platforms/#available-regions \ No newline at end of file +[azure-privatelink-architecture]: /static/images/azure-privatelink-architecture.svg \ No newline at end of file From 75a06f5efea9c3776dd54a7929eb3e9110b6ed1b Mon Sep 17 00:00:00 2001 From: atovpeko Date: Wed, 4 Feb 2026 12:31:20 +0200 Subject: [PATCH 04/11] draft --- use-timescale/security/index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/use-timescale/security/index.md b/use-timescale/security/index.md index 13b4135c64..653e951b79 100644 --- a/use-timescale/security/index.md +++ b/use-timescale/security/index.md @@ -17,9 +17,11 @@ Learn how $CLOUD_LONG protects your data and privacy. * Connect with a [stricter SSL mode][ssl-mode] * Secure your $SERVICE_SHORTs with [VPC peering][vpc-peering] * Connect to your $SERVICE_SHORTs from any cloud with [AWS Transit Gateway][transit-gateway] +* Secure your $SERVICE_SHORTs with [Azure Private Link][azure-privatelink] * Restrict access with an [IP address allow list][ip-allowlist] [2fa]: /use-timescale/:currentVersion:/security/multi-factor-authentication/ +[azure-privatelink]: /use-timescale/:currentVersion:/security/azure-privatelink/ [client-credentials]: /use-timescale/:currentVersion:/security/client-credentials/ [database-rbac]: /use-timescale/:currentVersion:/security/read-only-role/ [ip-allowlist]: /use-timescale/:currentVersion:/security/ip-allow-list/ From 69dd8ab371e9f0106856b5ac860ecdae63340ba0 Mon Sep 17 00:00:00 2001 From: atovpeko Date: Thu, 12 Feb 2026 14:53:43 +0200 Subject: [PATCH 05/11] update --- _partials/_azure-privatelink.md | 147 +++++++++++++++++++ _partials/_integration-prereqs-cloud-only.md | 4 +- use-timescale/security/azure-privatelink.md | 4 +- use-timescale/security/transit-gateway.md | 9 +- 4 files changed, 158 insertions(+), 6 deletions(-) create mode 100644 _partials/_azure-privatelink.md diff --git a/_partials/_azure-privatelink.md b/_partials/_azure-privatelink.md new file mode 100644 index 0000000000..5b02d5d64f --- /dev/null +++ b/_partials/_azure-privatelink.md @@ -0,0 +1,147 @@ +import IntegrationPrereqsCloud from "versionContent/_partials/_integration-prereqs-cloud-only.mdx"; + +## Prerequisites + + + +* Create an [Azure account](https://azure.microsoft.com/en-gb/pricing/purchase-options/azure-account) with an active subscription. +* Get [permissions](https://learn.microsoft.com/en-us/azure/private-link/rbac-permissions) to create private endpoints and manage network resources. +* Create an [Azure Virtual Network](https://learn.microsoft.com/en-us/azure/virtual-network/quickstart-create-virtual-network?tabs=portal) with a subnet. + +## Set up Azure Private Link connection + + + +1. **Create a Private Link authorization** + + 1. In [$CONSOLE_LONG][console-azure-privatelink], select `Security` > `Private Link` > `Setup Private Link`. + + 1. Enter your [Azure subscription ID](https://learn.microsoft.com/en-us/azure/azure-portal/get-subscription-tenant-id#find-your-azure-subscription) and specify a name for the Private Link connection. + + 1. Under `Alias`, copy the alias for the region in which you need to create the connection. + + While cross-region connection is possible, it is recommended to choose the region closest to your Azure resources, for optimal performance. + + 1. Click `Authorize`. Your connection appears in the list. + +1. **Create a private endpoint** + + 1. In [Azure Portal](https://azure.microsoft.com/en-us/get-started/azure-portal), search for and click `Private Link`. + 1. Click `Private endpoints` in the navigation tree on the left, then click `Create`. + 1. Configure the endpoint: + 1. In `Subscription`, select the subscription you have previously authorized in $CLOUD_LONG. + 1. In `Resource group`, select an existing resource group or create a new one for your private endpoint. + 1. Provide a name for your endpoint. + 1. Select the region where your Virtual Network is deployed. + 1. Click `Next: Resource`. + 1. In `Connection method`, select `Connect to an Azure resource by resource ID or alias`. + 1. In `Resource ID or alias`, paste the alias you have copied from $CONSOLE_LONG. + 1. In `Request message`, enter your [$PROJECT_LONG ID][find-connection-details]. + 1. Click `Next: Virtual Network`. + 1. Select the Virtual Network and subnet for your endpoint, optionally select an application security group, then click `Next: DNS`. + 1. Optionally configure private DNS integration, then click `Next: tags`. + 1. Optionally provide tags for your endpoint, then click `Next: Review + create`. + 1. Review your config and click `Create`. + + Azure deploys your private endpoint. Wait for the deployment to succeed. + +1. **Sync the connection** + + In [$CONSOLE_LONG][console-azure-privatelink] > `Security` > `Private Link`, click the refresh icon next to your connection. $CLOUD_LONG automatically approves connections from authorized subscriptions. Your connection status changes from `Pending` to `Approved`. + +1. **Copy your private endpoint IP** + + 1. In [Azure Portal](https://azure.microsoft.com/en-us/get-started/azure-portal) >`Private Link` > `Private endpoints`, check that the connection state for your private endpoint is `Approved`. + + 1. Copy the private endpoint IP from the `Private IP` column. + +1. **Update the connection with your private endpoint IP** + + In [$CONSOLE_LONG][console-azure-privatelink] > `Security` > `Private Link`, click the pencil icon under the IP address column for your connection, then paste the IP address you have copied from Azure Portal. + +1. **Attach your $SERVICE_SHORT to the private endpoint connection** + + 1. In [$CONSOLE_LONG][console-azure-privatelink], select the $SERVICE_SHORT and click `Operations` > `Security` > `Private Link`. + 1. Select the private endpoint connection in the drop-down and click `Attach`. + + + +## Test the connection + +After setting up Private Link, verify that the connection works. + + + +1. **From a resource inside your Azure VNet** (such as a VM or Azure App Service), test the connection: + + ```bash + psql "postgresql://username:password@your-service.eastus.tiger.cloud:5432/database" + ``` + +2. **Verify that the connection succeeds** + +3. **Try connecting from outside your VNet** (such as your local machine) + + The connection should fail, confirming that public access is disabled. + + + +## Manage Private Link connections + +### View connection status + +In [$CONSOLE > Security > Azure Private Link][console-azure-privatelink], you can view: +* All authorized Azure subscriptions +* Active Private Endpoint connections +* Connection status (Pending, Approved, Rejected) +* Service bindings + +### Remove a Private Link connection + +To disconnect a $SERVICE_LONG from a Private Endpoint: + + + +1. **In [$CONSOLE > Security > Azure Private Link][console-azure-privatelink], select your connection** +2. **Click the service binding you want to remove** +3. **Click `Remove Binding`** + +The $SERVICE_LONG returns to public access (if no other Private Link connection is active). + + + +### Delete a Private Endpoint in Azure + +If you delete a Private Endpoint in Azure, the connection becomes broken. Update your $CONSOLE to reflect this change: + + + +1. **Delete the Private Endpoint in Azure** + + ```bash + az network private-endpoint delete \ + --name tiger-private-endpoint \ + --resource-group tiger-privatelink-rg + ``` + +2. **In [$CONSOLE > Security > Azure Private Link][console-azure-privatelink], click `Sync Connections`** + + $CLOUD_LONG detects the removed connection and updates the status. + + + +## Regional considerations + +* **Cross-region connectivity**: Private Endpoints can connect to Private Link Services in different Azure regions, but for best performance, use the same region +* **Multiple regions**: You can create Private Endpoints in multiple regions connecting to the same $CLOUD_LONG region, or to different $CLOUD_LONG regions +* **Available regions**: Private Link Services are available in all [$CLOUD_LONG supported Azure regions][regions] + + + +After attaching a $SERVICE_SHORT to a Private Endpoint, it is no longer accessible from the public internet. Make sure all your applications are configured to connect through the Private Endpoint before creating the binding. + + + +[console-azure-privatelink]: https://console.cloud.timescale.com/dashboard/azure-privatelink +[find-connection-details]: /integrations/:currentVersion:/find-connection-details/ +[regions]: /about/:currentVersion:/supported-platforms/#available-regions \ No newline at end of file diff --git a/_partials/_integration-prereqs-cloud-only.md b/_partials/_integration-prereqs-cloud-only.md index ab90078704..2bacc07933 100644 --- a/_partials/_integration-prereqs-cloud-only.md +++ b/_partials/_integration-prereqs-cloud-only.md @@ -1,9 +1,7 @@ To follow the steps on this page: -* Create a target [$SERVICE_LONG][create-service] with the Real-time analytics capability. - - You need your [connection details][connection-info]. +* Create a target [$SERVICE_LONG][create-service] with the Real-time analytics capability. You need your [connection details][connection-info]. [connection-info]: /integrations/:currentVersion:/find-connection-details/ [create-service]: /getting-started/:currentVersion:/services/ diff --git a/use-timescale/security/azure-privatelink.md b/use-timescale/security/azure-privatelink.md index 57d18189e1..03c00b85fa 100644 --- a/use-timescale/security/azure-privatelink.md +++ b/use-timescale/security/azure-privatelink.md @@ -15,10 +15,10 @@ import AzurePrivateLink from "versionContent/_partials/_azure-privatelink.mdx"; # Secure your $CLOUD_LONG services with Azure Private Link -Azure Private Link creates a private connection between your Azure Virtual Network and $CLOUD_LONG services, eliminating exposure to the public internet. Applications in your Azure VNet connect to a Private Endpoint with a private IP address, which links to $CLOUD_LONG. Once connected, your $SERVICE_SHORTs become accessible only through the Private Endpoint, providing enhanced security, reduced attack surface, and compliance with data isolation requirements. +Azure Private Link creates a private connection between your Azure Virtual Network and $CLOUD_LONG services hosted on Azure, eliminating exposure to the public internet. Applications in your Azure VNet connect to a Private Endpoint with a private IP address, which links to $CLOUD_LONG. Once connected, your $SERVICE_SHORTs become accessible only through the Private Endpoint, providing enhanced security, reduced attack surface, and compliance with data isolation requirements. ![Azure Private Link architecture][azure-privatelink-architecture] -[azure-privatelink-architecture]: /static/images/azure-privatelink-architecture.svg \ No newline at end of file +[azure-privatelink-architecture]: https://assets.timescale.com/docs/images/tiger-cloud-console/azure-privatelink-architecture.svg \ No newline at end of file diff --git a/use-timescale/security/transit-gateway.md b/use-timescale/security/transit-gateway.md index 90afc283b8..8e2256fe64 100644 --- a/use-timescale/security/transit-gateway.md +++ b/use-timescale/security/transit-gateway.md @@ -15,7 +15,7 @@ import NotSupportedAzure from "versionContent/_partials/_not-supported-for-azure # Securely connect to $CLOUD_LONG using AWS Transit Gateway -[AWS Transit Gateway][aws-transit-gateway] enables you to securely connect to your $CLOUD_LONG from AWS, Google Cloud, Microsoft Azure, or any other cloud or on-premise environment. +[AWS Transit Gateway][aws-transit-gateway] enables you to securely connect to your **$CLOUD_LONG on AWS** from Google Cloud, Microsoft Azure, AWS, or any other cloud or on-premise environment. @@ -48,6 +48,12 @@ AWS Transit Gateway enables you to connect from almost any environment, this pag + + +These steps describe connecting **$CLOUD_LONG on AWS** to Microsoft Azure using AWS Transit Gateway. To connect **$CLOUD_LONG on Azure**, follow the steps in [Azure Private Link][azure-private-link]. + + + 1. **Connect your infrastructure to AWS Transit Gateway** @@ -92,6 +98,7 @@ AWS Transit Gateway enables you to connect from almost any environment, this pag You can now securely access your $SERVICE_SHORTs in $CLOUD_LONG. +[azure-private-link]: /use-timescale/:currentVersion:/security/azure-privatelink/ [aws-onprem]: https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/centralize-network-connectivity-using-aws-transit-gateway.html [aws-transit-gateway]: https://aws.amazon.com/transit-gateway/ [azure-aws]: https://aws.amazon.com/blogs/modernizing-with-aws/designing-private-network-connectivity-aws-azure/ From 4b30110a10951df4fc8a0adecb702ed268c8da42 Mon Sep 17 00:00:00 2001 From: atovpeko Date: Thu, 26 Feb 2026 13:22:37 +0200 Subject: [PATCH 06/11] update --- _partials/_azure-privatelink.md | 12 +++++++----- use-timescale/security/azure-privatelink.md | 2 +- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/_partials/_azure-privatelink.md b/_partials/_azure-privatelink.md index 5b02d5d64f..db24872a7e 100644 --- a/_partials/_azure-privatelink.md +++ b/_partials/_azure-privatelink.md @@ -5,24 +5,26 @@ import IntegrationPrereqsCloud from "versionContent/_partials/_integration-prere * Create an [Azure account](https://azure.microsoft.com/en-gb/pricing/purchase-options/azure-account) with an active subscription. -* Get [permissions](https://learn.microsoft.com/en-us/azure/private-link/rbac-permissions) to create private endpoints and manage network resources. +* Configure [permissions](https://learn.microsoft.com/en-us/azure/private-link/rbac-permissions) to create private endpoints and manage network resources. * Create an [Azure Virtual Network](https://learn.microsoft.com/en-us/azure/virtual-network/quickstart-create-virtual-network?tabs=portal) with a subnet. ## Set up Azure Private Link connection +Take the following steps to connect $CLOUD_LONG to Azure with Private Link: + 1. **Create a Private Link authorization** - 1. In [$CONSOLE_LONG][console-azure-privatelink], select `Security` > `Private Link` > `Setup Private Link`. + 1. In [$CONSOLE_LONG][console-azure-privatelink], select `Security` > `Private Endpoints` > `Configure Private Endpoint Connection`. 1. Enter your [Azure subscription ID](https://learn.microsoft.com/en-us/azure/azure-portal/get-subscription-tenant-id#find-your-azure-subscription) and specify a name for the Private Link connection. 1. Under `Alias`, copy the alias for the region in which you need to create the connection. - While cross-region connection is possible, it is recommended to choose the region closest to your Azure resources, for optimal performance. + Cross-region connection is possible, but it is recommended to choose the region closest to your Azure resources, for optimal performance. - 1. Click `Authorize`. Your connection appears in the list. + 1. Click `Done`. 1. **Create a private endpoint** @@ -39,7 +41,7 @@ import IntegrationPrereqsCloud from "versionContent/_partials/_integration-prere 1. In `Request message`, enter your [$PROJECT_LONG ID][find-connection-details]. 1. Click `Next: Virtual Network`. 1. Select the Virtual Network and subnet for your endpoint, optionally select an application security group, then click `Next: DNS`. - 1. Optionally configure private DNS integration, then click `Next: tags`. + 1. Optionally configure private DNS integration, then click `Next: Tags`. 1. Optionally provide tags for your endpoint, then click `Next: Review + create`. 1. Review your config and click `Create`. diff --git a/use-timescale/security/azure-privatelink.md b/use-timescale/security/azure-privatelink.md index 03c00b85fa..7f6764593c 100644 --- a/use-timescale/security/azure-privatelink.md +++ b/use-timescale/security/azure-privatelink.md @@ -15,7 +15,7 @@ import AzurePrivateLink from "versionContent/_partials/_azure-privatelink.mdx"; # Secure your $CLOUD_LONG services with Azure Private Link -Azure Private Link creates a private connection between your Azure Virtual Network and $CLOUD_LONG services hosted on Azure, eliminating exposure to the public internet. Applications in your Azure VNet connect to a Private Endpoint with a private IP address, which links to $CLOUD_LONG. Once connected, your $SERVICE_SHORTs become accessible only through the Private Endpoint, providing enhanced security, reduced attack surface, and compliance with data isolation requirements. +Azure Private Link creates a private connection between your Azure Virtual Network and $SERVICE_LONGs hosted on Azure, eliminating exposure to the public internet. Applications in your Azure VNet connect to a Private Endpoint with a private IP address, which links to $CLOUD_LONG. Once connected, your $SERVICE_SHORTs become accessible only through the Private Endpoint, providing enhanced security, reduced attack surface, and compliance with data isolation requirements. ![Azure Private Link architecture][azure-privatelink-architecture] From e3381cfae695d088f92213d3cd0b7c5d35945ce7 Mon Sep 17 00:00:00 2001 From: atovpeko Date: Thu, 26 Feb 2026 17:49:36 +0200 Subject: [PATCH 07/11] update --- _partials/_azure-privatelink.md | 132 ++++++-------------- integrations/microsoft-azure.md | 42 +------ use-timescale/security/azure-privatelink.md | 3 + 3 files changed, 43 insertions(+), 134 deletions(-) diff --git a/_partials/_azure-privatelink.md b/_partials/_azure-privatelink.md index db24872a7e..2ccb4f6d1f 100644 --- a/_partials/_azure-privatelink.md +++ b/_partials/_azure-privatelink.md @@ -6,7 +6,7 @@ import IntegrationPrereqsCloud from "versionContent/_partials/_integration-prere * Create an [Azure account](https://azure.microsoft.com/en-gb/pricing/purchase-options/azure-account) with an active subscription. * Configure [permissions](https://learn.microsoft.com/en-us/azure/private-link/rbac-permissions) to create private endpoints and manage network resources. -* Create an [Azure Virtual Network](https://learn.microsoft.com/en-us/azure/virtual-network/quickstart-create-virtual-network?tabs=portal) with a subnet. +* Create an [Azure Virtual Network](https://learn.microsoft.com/en-us/azure/virtual-network/quickstart-create-virtual-network?tabs=portal) with a subnet for the resources you will connect to $CLOUD_LONG. ## Set up Azure Private Link connection @@ -14,136 +14,76 @@ Take the following steps to connect $CLOUD_LONG to Azure with Private Link: -1. **Create a Private Link authorization** +1. **Create a Private Link subscription authorization** 1. In [$CONSOLE_LONG][console-azure-privatelink], select `Security` > `Private Endpoints` > `Configure Private Endpoint Connection`. - 1. Enter your [Azure subscription ID](https://learn.microsoft.com/en-us/azure/azure-portal/get-subscription-tenant-id#find-your-azure-subscription) and specify a name for the Private Link connection. + 1. Enter your [Azure subscription ID](https://learn.microsoft.com/en-us/azure/azure-portal/get-subscription-tenant-id#find-your-azure-subscription) and specify a name for the Private Link authorization, then click a checkmark next to it. + + ![Azure Private Link authorization][azure-privatelink-authorization] 1. Under `Alias`, copy the alias for the region in which you need to create the connection. - Cross-region connection is possible, but it is recommended to choose the region closest to your Azure resources, for optimal performance. + Choose the region closest to your Azure resources for optimal performance. 1. Click `Done`. + $CLOUD_LONG confirms your authorization. + + ![Azure Private Link authorization complete][azure-privatelink-authorization-complete] + 1. **Create a private endpoint** - 1. In [Azure Portal](https://azure.microsoft.com/en-us/get-started/azure-portal), search for and click `Private Link`. - 1. Click `Private endpoints` in the navigation tree on the left, then click `Create`. + 1. In [Azure Portal](https://azure.microsoft.com/en-us/get-started/azure-portal), go to `Private endpoints` and click `Create`. + + ![Create Azure Private Endpoint][create-azure-endpoint] + 1. Configure the endpoint: 1. In `Subscription`, select the subscription you have previously authorized in $CLOUD_LONG. 1. In `Resource group`, select an existing resource group or create a new one for your private endpoint. 1. Provide a name for your endpoint. - 1. Select the region where your Virtual Network is deployed. - 1. Click `Next: Resource`. + 1. Select the region where your Virtual Network is deployed, then click `Next: Resource`. 1. In `Connection method`, select `Connect to an Azure resource by resource ID or alias`. 1. In `Resource ID or alias`, paste the alias you have copied from $CONSOLE_LONG. - 1. In `Request message`, enter your [$PROJECT_LONG ID][find-connection-details]. - 1. Click `Next: Virtual Network`. + 1. In `Request message`, enter your [$PROJECT_LONG ID][find-connection-details], then click `Next: Virtual Network`. 1. Select the Virtual Network and subnet for your endpoint, optionally select an application security group, then click `Next: DNS`. - 1. Optionally configure private DNS integration, then click `Next: Tags`. - 1. Optionally provide tags for your endpoint, then click `Next: Review + create`. + 1. Optionally configure private DNS integration and tags for your endpoint, then click `Next: Review + create`. 1. Review your config and click `Create`. - - Azure deploys your private endpoint. Wait for the deployment to succeed. + Azure creates your private endpoint. Wait for the deployment to succeed. + 1. Go to `Private endpoints` and copy the private endpoint IP from the `Private IP` column. 1. **Sync the connection** - In [$CONSOLE_LONG][console-azure-privatelink] > `Security` > `Private Link`, click the refresh icon next to your connection. $CLOUD_LONG automatically approves connections from authorized subscriptions. Your connection status changes from `Pending` to `Approved`. - -1. **Copy your private endpoint IP** - - 1. In [Azure Portal](https://azure.microsoft.com/en-us/get-started/azure-portal) >`Private Link` > `Private endpoints`, check that the connection state for your private endpoint is `Approved`. - - 1. Copy the private endpoint IP from the `Private IP` column. - -1. **Update the connection with your private endpoint IP** - - In [$CONSOLE_LONG][console-azure-privatelink] > `Security` > `Private Link`, click the pencil icon under the IP address column for your connection, then paste the IP address you have copied from Azure Portal. - -1. **Attach your $SERVICE_SHORT to the private endpoint connection** - - 1. In [$CONSOLE_LONG][console-azure-privatelink], select the $SERVICE_SHORT and click `Operations` > `Security` > `Private Link`. - 1. Select the private endpoint connection in the drop-down and click `Attach`. - - - -## Test the connection - -After setting up Private Link, verify that the connection works. - - - -1. **From a resource inside your Azure VNet** (such as a VM or Azure App Service), test the connection: + 1. In [$CONSOLE_LONG][console-azure-privatelink] > `Security` > `Private Link`, click `Refresh`. $CLOUD_LONG automatically approves connections from authorized subscriptions. Your connection appears in the list. - ```bash - psql "postgresql://username:password@your-service.eastus.tiger.cloud:5432/database" - ``` + ![Azure Private Endpoint IP][azure-private-endpoint-ip] -2. **Verify that the connection succeeds** + 1. Click `Add IP` and paste the IP address you have copied from Azure Portal. -3. **Try connecting from outside your VNet** (such as your local machine) + 1. Click the three dots next to your connection and select `+ Attach service`. Select your $SERVICE_SHORT from the dropdown and click `Attach`. You can attach a $SERVICE_SHORT to one Private Endpoint connection. - The connection should fail, confirming that public access is disabled. + - - -## Manage Private Link connections - -### View connection status - -In [$CONSOLE > Security > Azure Private Link][console-azure-privatelink], you can view: -* All authorized Azure subscriptions -* Active Private Endpoint connections -* Connection status (Pending, Approved, Rejected) -* Service bindings - -### Remove a Private Link connection + After attaching a $SERVICE_SHORT to a Private Endpoint, it is no longer accessible from the public internet. Make sure all your applications are configured to connect through the Private Endpoint before attaching your $SERVICE_SHORT. -To disconnect a $SERVICE_LONG from a Private Endpoint: + - - -1. **In [$CONSOLE > Security > Azure Private Link][console-azure-privatelink], select your connection** -2. **Click the service binding you want to remove** -3. **Click `Remove Binding`** - -The $SERVICE_LONG returns to public access (if no other Private Link connection is active). + 1. From a VM inside your Azure VNet, connect to your $SERVICE_SHORT using a connection string with your [connection details][find-connection-details]. You should be able to connect successfully. -### Delete a Private Endpoint in Azure - -If you delete a Private Endpoint in Azure, the connection becomes broken. Update your $CONSOLE to reflect this change: - - - -1. **Delete the Private Endpoint in Azure** - - ```bash - az network private-endpoint delete \ - --name tiger-private-endpoint \ - --resource-group tiger-privatelink-rg - ``` - -2. **In [$CONSOLE > Security > Azure Private Link][console-azure-privatelink], click `Sync Connections`** - - $CLOUD_LONG detects the removed connection and updates the status. - - - -## Regional considerations - -* **Cross-region connectivity**: Private Endpoints can connect to Private Link Services in different Azure regions, but for best performance, use the same region -* **Multiple regions**: You can create Private Endpoints in multiple regions connecting to the same $CLOUD_LONG region, or to different $CLOUD_LONG regions -* **Available regions**: Private Link Services are available in all [$CLOUD_LONG supported Azure regions][regions] - +## Manage connections -After attaching a $SERVICE_SHORT to a Private Endpoint, it is no longer accessible from the public internet. Make sure all your applications are configured to connect through the Private Endpoint before creating the binding. +- To detach a $SERVICE_SHORT from a Private Endpoint connection, go to `Security` > `Private Endpoints` and expand the details of the corresponding connection. Click the trash bin icon and confirm detaching your $SERVICE_SHORT. +- To edit or remove a connection, click the three dots next to the connection in the list and select `Edit` or `Disconnect`, respectively. Detach $SERVICE_SHORTs from the connection before deleting it. +- To remove an authorization, click `Manage Authorizations` > trash bin icon. Disconnect all relevant connections before removing an authorization. - [console-azure-privatelink]: https://console.cloud.timescale.com/dashboard/azure-privatelink [find-connection-details]: /integrations/:currentVersion:/find-connection-details/ -[regions]: /about/:currentVersion:/supported-platforms/#available-regions \ No newline at end of file +[regions]: /about/:currentVersion:/supported-platforms/#available-regions +[azure-privatelink-authorization]: https://assets.timescale.com/docs/images/tiger-cloud-console/configure-private-link-authorization.png +[azure-privatelink-authorization-complete]: https://assets.timescale.com/docs/images/tiger-cloud-console/private-link-authorization-complete.png +[azure-private-endpoint-ip]: https://assets.timescale.com/docs/images/tiger-cloud-console/private-link-add-ip.png +[create-azure-endpoint]: https://assets.timescale.com/docs/images/tiger-cloud-console/create-private-endpoint-azure.png \ No newline at end of file diff --git a/integrations/microsoft-azure.md b/integrations/microsoft-azure.md index 0d9b585243..adcf1c25a9 100644 --- a/integrations/microsoft-azure.md +++ b/integrations/microsoft-azure.md @@ -9,51 +9,17 @@ keywords: [Azure, integrations] import IntegrationPrereqsCloud from "versionContent/_partials/_integration-prereqs-cloud-only.mdx"; import TransitGateway from "versionContent/_partials/_transit-gateway.mdx"; import AzurePrivateLink from "versionContent/_partials/_azure-privatelink.mdx"; +import NotSupportedAws from "versionContent/_partials/_not-supported-for-aws.mdx"; # Integrate Microsoft Azure with $CLOUD_LONG - [Microsoft Azure][azure] is a cloud computing platform and services suite, offering infrastructure, AI, analytics, security, and developer tools to help businesses build, deploy, and manage applications. - - - - -This page explains how to integrate your Microsoft Azure infrastructure with $CLOUD_LONG on AWS using [AWS Transit Gateway][aws-transit-gateway]. - -## Prerequisites - - - -- Set up [AWS Transit Gateway][gtw-setup]. - -## Connect your Microsoft Azure infrastructure to your $SERVICE_LONGs - -To connect to $CLOUD_LONG: - - +This page explains how to integrate your Microsoft Azure infrastructure with $CLOUD_LONG on Azure using [Azure Private Link][azure-private-link]. -1. **Connect your infrastructure to AWS Transit Gateway** - - Establish connectivity between Azure and AWS. See the [AWS architectural documentation][azure-aws] for details. - - - - - -You have successfully integrated your Microsoft Azure infrastructure with $CLOUD_LONG. - - - - + - - - - -[aws-transit-gateway]: https://aws.amazon.com/transit-gateway/ -[azure-aws]: https://aws.amazon.com/blogs/modernizing-with-aws/designing-private-network-connectivity-aws-azure/ +[azure-private-link]: https://learn.microsoft.com/en-us/azure/private-link/private-link-overview [azure]: https://azure.microsoft.com/en-gb/ -[gtw-setup]: https://docs.aws.amazon.com/vpc/latest/tgw/tgw-getting-started.html diff --git a/use-timescale/security/azure-privatelink.md b/use-timescale/security/azure-privatelink.md index 7f6764593c..257eb0aa9b 100644 --- a/use-timescale/security/azure-privatelink.md +++ b/use-timescale/security/azure-privatelink.md @@ -12,6 +12,7 @@ cloud_ui: import IntegrationPrereqsCloud from "versionContent/_partials/_integration-prereqs-cloud-only.mdx"; import AzurePrivateLink from "versionContent/_partials/_azure-privatelink.mdx"; +import NotSupportedAws from "versionContent/_partials/_not-supported-for-aws.mdx"; # Secure your $CLOUD_LONG services with Azure Private Link @@ -19,6 +20,8 @@ Azure Private Link creates a private connection between your Azure Virtual Netwo ![Azure Private Link architecture][azure-privatelink-architecture] + + [azure-privatelink-architecture]: https://assets.timescale.com/docs/images/tiger-cloud-console/azure-privatelink-architecture.svg \ No newline at end of file From de692ae5ee1bbe1bcb4c3525fe9ab3d261e777da Mon Sep 17 00:00:00 2001 From: atovpeko Date: Thu, 26 Feb 2026 18:00:58 +0200 Subject: [PATCH 08/11] Add missing _not-supported-for-aws partial This file was referenced by azure-privatelink.md and microsoft-azure.md but was not tracked in git, causing CI build failures. Co-Authored-By: Claude Opus 4.6 --- _partials/_not-supported-for-aws.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 _partials/_not-supported-for-aws.md diff --git a/_partials/_not-supported-for-aws.md b/_partials/_not-supported-for-aws.md new file mode 100644 index 0000000000..4a3817d9c3 --- /dev/null +++ b/_partials/_not-supported-for-aws.md @@ -0,0 +1,5 @@ + + +This feature is currently not supported for $CLOUD_LONG on AWS. + + \ No newline at end of file From f29e66ef8b42337a14d2c6fb29bdbae25bb2fd58 Mon Sep 17 00:00:00 2001 From: atovpeko Date: Mon, 2 Mar 2026 12:59:28 +0200 Subject: [PATCH 09/11] update --- _partials/_azure-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_partials/_azure-features.md b/_partials/_azure-features.md index 5781f39496..30fcb34737 100644 --- a/_partials/_azure-features.md +++ b/_partials/_azure-features.md @@ -40,7 +40,7 @@ The features included in each [$PRICING_PLAN][pricing-plans] are: | **Security and compliance** | | | | | | Role-based access | ✓ | ✓ | ✓ | ✓ | | End-to-end encryption | ✓ | ✓ | ✓ | ✓ | -| Azure Private Link | | ||| +| Azure Private Link | | |✓|✓| | [HIPAA compliance][hipaa-compliance] | | | | ✓ | | IP address allow list | 1 list with up to 10 IP addresses | 1 list with up to 10 IP addresses | Up to 10 lists with up to 10 IP addresses each | Up to 10 lists with up to 100 IP addresses each | | Multi-factor authentication | ✓ | ✓ | ✓ | ✓ | From eb6f215f50b6a1ae2c54f015893ce155f969b6df Mon Sep 17 00:00:00 2001 From: atovpeko Date: Wed, 11 Mar 2026 14:54:42 +0200 Subject: [PATCH 10/11] update --- _partials/_azure-privatelink.md | 6 +++--- use-timescale/security/azure-privatelink.md | 3 --- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/_partials/_azure-privatelink.md b/_partials/_azure-privatelink.md index 2ccb4f6d1f..52a3655ce8 100644 --- a/_partials/_azure-privatelink.md +++ b/_partials/_azure-privatelink.md @@ -1,8 +1,8 @@ -import IntegrationPrereqsCloud from "versionContent/_partials/_integration-prereqs-cloud-only.mdx"; +import IntegrationPrereqsNoConnection from "versionContent/_partials/_prereqs-cloud-no-connection.mdx"; ## Prerequisites - + * Create an [Azure account](https://azure.microsoft.com/en-gb/pricing/purchase-options/azure-account) with an active subscription. * Configure [permissions](https://learn.microsoft.com/en-us/azure/private-link/rbac-permissions) to create private endpoints and manage network resources. @@ -28,7 +28,7 @@ Take the following steps to connect $CLOUD_LONG to Azure with Private Link: 1. Click `Done`. - $CLOUD_LONG confirms your authorization. + $CLOUD_LONG confirms your authorization. Once it is confirmed, you can create multiple private endpoints from the same authorized subscription. ![Azure Private Link authorization complete][azure-privatelink-authorization-complete] diff --git a/use-timescale/security/azure-privatelink.md b/use-timescale/security/azure-privatelink.md index 257eb0aa9b..9a497396e0 100644 --- a/use-timescale/security/azure-privatelink.md +++ b/use-timescale/security/azure-privatelink.md @@ -10,7 +10,6 @@ cloud_ui: - [services, :serviceId, operations, azure-privatelink] --- -import IntegrationPrereqsCloud from "versionContent/_partials/_integration-prereqs-cloud-only.mdx"; import AzurePrivateLink from "versionContent/_partials/_azure-privatelink.mdx"; import NotSupportedAws from "versionContent/_partials/_not-supported-for-aws.mdx"; @@ -18,8 +17,6 @@ import NotSupportedAws from "versionContent/_partials/_not-supported-for-aws.mdx Azure Private Link creates a private connection between your Azure Virtual Network and $SERVICE_LONGs hosted on Azure, eliminating exposure to the public internet. Applications in your Azure VNet connect to a Private Endpoint with a private IP address, which links to $CLOUD_LONG. Once connected, your $SERVICE_SHORTs become accessible only through the Private Endpoint, providing enhanced security, reduced attack surface, and compliance with data isolation requirements. -![Azure Private Link architecture][azure-privatelink-architecture] - From b49e3abc659b7bb5bceb8c51fd9fda89c1cf9ae0 Mon Sep 17 00:00:00 2001 From: atovpeko Date: Thu, 12 Mar 2026 14:49:26 +0200 Subject: [PATCH 11/11] update on review --- _partials/_azure-privatelink.md | 6 ++ about/feature-comparison.md | 171 ++++++++++++++++---------------- 2 files changed, 92 insertions(+), 85 deletions(-) diff --git a/_partials/_azure-privatelink.md b/_partials/_azure-privatelink.md index 52a3655ce8..d7dc1231da 100644 --- a/_partials/_azure-privatelink.md +++ b/_partials/_azure-privatelink.md @@ -10,6 +10,12 @@ import IntegrationPrereqsNoConnection from "versionContent/_partials/_prereqs-cl ## Set up Azure Private Link connection + + +Azure Private Link is currently in private preview. To request access in $CONSOLE_LONG, go to `Security` > `Private Endpoints` and click `Request access`. Then refresh the page and follow the steps below. + + + Take the following steps to connect $CLOUD_LONG to Azure with Private Link: diff --git a/about/feature-comparison.md b/about/feature-comparison.md index 4e198d771c..4a7e6a5e80 100644 --- a/about/feature-comparison.md +++ b/about/feature-comparison.md @@ -9,93 +9,94 @@ keywords: [TimescaleDB, Tiger Cloud] The following table compares the features available in $CLOUD_LONG and self-hosted $TDB_COMMUNITY. -| Feature | $CLOUD_LONG on AWS | $CLOUD_LONG on Azure | self-hosted $TIMESCALE_DB | -|---------------------------------------------------------------------------------------------------------------|-----------------------------------|------------------------------------|---------------------------------------------| -| **Best-in-сlass $PG performance** | | | | -| Automatic partitioning via hypertables for efficient indexes and faster ingest | ✓ | ✓ | ✓ | -| Continuous aggregates | ✓ | ✓ | ✓ | -| Time/partition-oriented constraint exclusion for faster queries | ✓ | ✓ | ✓ | -| Skip scans, ordered appends, custom optimizations for faster `LIMIT` and `DISTINCT` queries | ✓ | ✓ | ✓ | -| Columnar storage for accelerated scans | ✓ | ✓ | ✓ | -| Vectorized query execution (SIMD) | ✓ | ✓ | ✓ | -| Specialized vector indexes for AI applications | ✓ | ✓ | ✓ | -| $PG_CONNECTOR_CAP | ✓ | ✓ | Manual | -| $S3_CONNECTOR_CAP | ✓ | ✗ | ✗ | -| Source Apache Kafka connector | ✓ | ✗ | ✗ | -| $LAKE_LONG destination connector from $CLOUD_LONG to Iceberg-backed S3 Tables | ✓ | ✗ | ✗ | -| In-Console CSV, Parquet, and text file imports | ✓ | ✗ | ✗ | -| **Flexible analysis with full SQL** | | | | -| Complete $PG ecosystem including all $PG features, connectors, and third-party drivers | ✓ | ✓ | ✓ | -| Cross-table JOINs for time-series and events tables with relational tables | ✓ | ✓ | ✓ | -| Rich timestamp and timezone support | ✓ | ✓ | ✓ | -| Flexible time-bucketing for time-oriented analysis | ✓ | ✓ | ✓ | -| Advanced hyperfunctions including interpolation, approximation, and visualization functions | ✓ | ✓ | ✓ | -| Geospatial and vector data types | ✓ | ✓ | ✓ | -| **Automated data management** | | | | -| Native compression (up to 98% storage savings) | ✓ | ✓ | ✓ | -| Columnar storage format with fast scans | ✓ | ✓ | ✓ | -| Data retention policies | ✓ | ✓ | ✓ | -| Data tiering with automated policies | ✓ | ✓ | ✗ | -| Data reordering for efficient disk scans | ✓ | ✓ | ✓ | -| Data downsampling for efficient historical analysis | ✓ | ✓ | ✓ | -| Background job scheduler and user-defined jobs | ✓ | ✓ | ✓ | -| **Enterprise scalability** | | | | -| Disaggregated compute and storage | ✓ | ✓ | Manual | -| Dynamic compute resizing | ✓ | ✓ | ✗ | -| Dynamic disk storage with usage-based pricing | ✓ | ✓ | ✗ | -| Dynamic I/O provisioning for high-read/ high-write performance | ✓ | ✓ | Manual | +| Feature | $CLOUD_LONG on AWS | $CLOUD_LONG on Azure | self-hosted $TIMESCALE_DB | +|---------------------------------------------------------------------------------------------------------------|-----------------------------------|-------------------------------------|---------------------------------------------| +| **Best-in-сlass $PG performance** | | | | +| Automatic partitioning via hypertables for efficient indexes and faster ingest | ✓ | ✓ | ✓ | +| Continuous aggregates | ✓ | ✓ | ✓ | +| Time/partition-oriented constraint exclusion for faster queries | ✓ | ✓ | ✓ | +| Skip scans, ordered appends, custom optimizations for faster `LIMIT` and `DISTINCT` queries | ✓ | ✓ | ✓ | +| Columnar storage for accelerated scans | ✓ | ✓ | ✓ | +| Vectorized query execution (SIMD) | ✓ | ✓ | ✓ | +| Specialized vector indexes for AI applications | ✓ | ✓ | ✓ | +| $PG_CONNECTOR_CAP | ✓ | ✓ | Manual | +| $S3_CONNECTOR_CAP | ✓ | ✗ | ✗ | +| Source Apache Kafka connector | ✓ | ✗ | ✗ | +| $LAKE_LONG destination connector from $CLOUD_LONG to Iceberg-backed S3 Tables | ✓ | ✗ | ✗ | +| In-Console CSV, Parquet, and text file imports | ✓ | ✗ | ✗ | +| **Flexible analysis with full SQL** | | | | +| Complete $PG ecosystem including all $PG features, connectors, and third-party drivers | ✓ | ✓ | ✓ | +| Cross-table JOINs for time-series and events tables with relational tables | ✓ | ✓ | ✓ | +| Rich timestamp and timezone support | ✓ | ✓ | ✓ | +| Flexible time-bucketing for time-oriented analysis | ✓ | ✓ | ✓ | +| Advanced hyperfunctions including interpolation, approximation, and visualization functions | ✓ | ✓ | ✓ | +| Geospatial and vector data types | ✓ | ✓ | ✓ | +| **Automated data management** | | | | +| Native compression (up to 98% storage savings) | ✓ | ✓ | ✓ | +| Columnar storage format with fast scans | ✓ | ✓ | ✓ | +| Data retention policies | ✓ | ✓ | ✓ | +| Data tiering with automated policies | ✓ | ✓ | ✗ | +| Data reordering for efficient disk scans | ✓ | ✓ | ✓ | +| Data downsampling for efficient historical analysis | ✓ | ✓ | ✓ | +| Background job scheduler and user-defined jobs | ✓ | ✓ | ✓ | +| **Enterprise scalability** | | | | +| Disaggregated compute and storage | ✓ | ✓ | Manual | +| Dynamic compute resizing | ✓ | ✓ | ✗ | +| Dynamic disk storage with usage-based pricing | ✓ | ✓ | ✗ | +| Dynamic I/O provisioning for high-read/ high-write performance | ✓ | ✓ | Manual | | Low-cost storage with infinite capacity | ✓ | ✓ | ✗ | -| Transparent queries across high-performance and low-cost tiers | ✓ | ✓ | ✗ | -| Read replicas with load balancing for seamless read scaling | ✓ | ✓ | Manual | -| Connection pooling for connection scaling | ✓ | ✓ | Manual | -| Automated resource-aware parameter tuning | ✓ | ✓ | ✗ | -| Terraform for infrastructure-as-code control | ✓ | ✓ | ✗ | -| **High availability and reliability** | | | | -| Multi-AZ deployments for high availability | ✓ | ✓ | Manual | -| Continuous incremental backup and automated restore | ✓ | ✓ | Manual | +| Transparent queries across high-performance and low-cost tiers | ✓ | ✓ | ✗ | +| Read replicas with load balancing for seamless read scaling | ✓ | ✓ | Manual | +| Connection pooling for connection scaling | ✓ | ✓ | Manual | +| Automated resource-aware parameter tuning | ✓ | ✓ | ✗ | +| Terraform for infrastructure-as-code control | ✓ | ✓ | ✗ | +| **High availability and reliability** | | | | +| Multi-AZ deployments for high availability | ✓ | ✓ | Manual | +| Continuous incremental backup and automated restore | ✓ | ✓ | Manual | | Cross-region backup | ✓ | 🔜 | ✗ | -| Point-in-time recovery and branching | ✓ | ✓ | Manual | -| Regular database and disk snapshots to enable fast restore | ✓ | ✓ | ✗ | -| Rapid recovery for all services by fast database restart and remote disk remount | ✓ | ✓ | ✗ | -| Memory guard protections to avoid database out-of-memory crashes | ✓ | ✓ | ✗ | -| Decoupled control/data planes for greater resilience | ✓ | ✓ | ✗ | -| Commercial SLAs | ✓ | ✓ | ✗ | -| **Automated upgrades and software patching** | | | | -| Automated upgrades during maintenance windows | ✓ | ✓ | ✗ | -| Phased, zero-downtime $TIMESCALE_DB and $PG minor upgrades | ✓ | ✓ | ✗ | -| $PG major version upgrades with forking workflow and disk snapshots to minimize downtime | ✓ | ✓ | ✗ | -| HA-replica-aware coordinated upgrades | ✓ | ✓ | ✗ | -| Fleet-wide version and stability monitoring with staged roll-out/roll-back upgrades | ✓ | ✓ | ✗ | -| **Security and compliance** | | | | -| SOC 2 Type 2, GDPR, HIPAA certified compliance | ✓ | ✓ | ✗ | -| Data encryption at rest (both disk and backup) | ✓ | ✓ | Manual | -| Data encryption in transit | ✓ | ✓ | Manual | -| Database SSL with fully verifiable certificate chains | ✓ | ✓ | ✗ | -| Control plane role-based access control | ✓ | ✓ | ✗ | -| Database role-based access control | ✓ | ✓ | ✓ | -| Multi-factor authentication | ✓ | ✓ | ✗ | -| Corporate SSO and SAML | ✓ | ✓ | ✗ | -| VPC peering | ✓ | ✗ | ✗ | -| AWS Transit Gateway | ✓ | ✗ | ✗ | -| Layered database "privilege escalation" protections | ✓ | ✓ | ✗ | -| Secure SDLC practices and vulnerability scanning, third-party pen testing | ✓ | ✓ | ✗ | -| **Deep observability** | | | | -| Operational database visibility to understand performance, uncover regressions, optimize performance | ✓ | ✓ | ✗ | -| Automated query analysis and statistics | ✓ | ✓ | ✗ | -| Per-query drill-downs into execution times, row results, plans, memory buffer management, cache performance | ✓ | ✓ | ✗ | -| In-Console metric visualization and system logs | ✓ | ✓ | ✗ | -| AWS CloudWatch exporter | ✓ | ✗ | ✗ | -| Prometheus exporter | ✓ | ✓ | ✗ | -| Datadog exporter | ✓ | ✓ | ✗ | -| Azure Monitor exporter | ✗ | ✓ | ✗ | -| Connection monitoring | ✓ | ✓ | Manual | -| Connection management | ✓ | ✓ | Manual | -| **Production-grade support and operations** | | | | -| 24/7 follow-the-sun support with global support team across APAC, EMEA, and Americas | ✓ | ✓ | [Contact sales][contact-sales] | -| Production support (severity 1) | ✓ | ✓ | [Contact sales][contact-sales] | -| Architectural reviews, data modeling, and query optimization and assistance, feature testing, and migration support | ✓ | ✓ | [Contact sales][contact-sales] | -| 24/7 operational monitoring and control | ✓ | ✓ | [Contact sales][contact-sales] | -| 98%+ customer satisfaction (CSAT scores) | ✓ | ✓ | [Contact sales][contact-sales] | +| Point-in-time recovery and branching | ✓ | ✓ | Manual | +| Regular database and disk snapshots to enable fast restore | ✓ | ✓ | ✗ | +| Rapid recovery for all services by fast database restart and remote disk remount | ✓ | ✓ | ✗ | +| Memory guard protections to avoid database out-of-memory crashes | ✓ | ✓ | ✗ | +| Decoupled control/data planes for greater resilience | ✓ | ✓ | ✗ | +| Commercial SLAs | ✓ | ✓ | ✗ | +| **Automated upgrades and software patching** | | | | +| Automated upgrades during maintenance windows | ✓ | ✓ | ✗ | +| Phased, zero-downtime $TIMESCALE_DB and $PG minor upgrades | ✓ | ✓ | ✗ | +| $PG major version upgrades with forking workflow and disk snapshots to minimize downtime | ✓ | ✓ | ✗ | +| HA-replica-aware coordinated upgrades | ✓ | ✓ | ✗ | +| Fleet-wide version and stability monitoring with staged roll-out/roll-back upgrades | ✓ | ✓ | ✗ | +| **Security and compliance** | | | | +| SOC 2 Type 2, GDPR, HIPAA certified compliance | ✓ | ✓ | ✗ | +| Data encryption at rest (both disk and backup) | ✓ | ✓ | Manual | +| Data encryption in transit | ✓ | ✓ | Manual | +| Database SSL with fully verifiable certificate chains | ✓ | ✓ | ✗ | +| Control plane role-based access control | ✓ | ✓ | ✗ | +| Database role-based access control | ✓ | ✓ | ✓ | +| Multi-factor authentication | ✓ | ✓ | ✗ | +| Corporate SSO and SAML | ✓ | ✓ | ✗ | +| VPC peering | ✓ | ✗ | ✗ | +| AWS Transit Gateway | ✓ | ✗ | ✗ | +| Azure Private Link | ✗ | ✓ | ✗ | +| Layered database "privilege escalation" protections | ✓ | ✓ | ✗ | +| Secure SDLC practices and vulnerability scanning, third-party pen testing | ✓ | ✓ | ✗ | +| **Deep observability** | | | | +| Operational database visibility to understand performance, uncover regressions, optimize performance | ✓ | ✓ | ✗ | +| Automated query analysis and statistics | ✓ | ✓ | ✗ | +| Per-query drill-downs into execution times, row results, plans, memory buffer management, cache performance | ✓ | ✓ | ✗ | +| In-Console metric visualization and system logs | ✓ | ✓ | ✗ | +| AWS CloudWatch exporter | ✓ | ✗ | ✗ | +| Prometheus exporter | ✓ | ✓ | ✗ | +| Datadog exporter | ✓ | ✓ | ✗ | +| Azure Monitor exporter | ✗ | ✓ | ✗ | +| Connection monitoring | ✓ | ✓ | Manual | +| Connection management | ✓ | ✓ | Manual | +| **Production-grade support and operations** | | | | +| 24/7 follow-the-sun support with global support team across APAC, EMEA, and Americas | ✓ | ✓ | [Contact sales][contact-sales] | +| Production support (severity 1) | ✓ | ✓ | [Contact sales][contact-sales] | +| Architectural reviews, data modeling, and query optimization and assistance, feature testing, and migration support | ✓ | ✓ | [Contact sales][contact-sales] | +| 24/7 operational monitoring and control | ✓ | ✓ | [Contact sales][contact-sales] | +| 98%+ customer satisfaction (CSAT scores) | ✓ | ✓ | [Contact sales][contact-sales] | [contact-sales]: mailto:sales@tigerdata.com