> ## Documentation Index
> Fetch the complete documentation index at: https://private-7c7dfe99-trino-dialect.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> 将 Amazon RDS MariaDB 配置为 ClickPipes 数据源的分步指南

# RDS MariaDB 数据源设置指南

export const IAMAuthentication = ({engine, service, children}) => {
  const services = {
    aurora: {
      name: 'Aurora',
      resource: 'cluster',
      id: 'cluster-xxxxxxxxxxxxxx'
    },
    rds: {
      name: 'RDS',
      resource: 'instance',
      id: 'db-xxxxxxxxxxxxxx'
    }
  };
  const createUserStatements = {
    postgres: `CREATE USER clickpipes_iam_user;
GRANT rds_iam TO clickpipes_iam_user;`,
    mysql: `CREATE USER 'clickpipes_iam_user' IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';`
  };
  const svc = services[String(service).toLowerCase()];
  const createUserSql = createUserStatements[String(engine).toLowerCase()];
  if (!svc) throw new Error(`Unsupported IAM authentication service: ${service}`);
  if (!createUserSql) throw new Error(`Unsupported IAM authentication engine: ${engine}`);
  return <>
      <p>
        Instead of a password, you can authenticate the ClickPipes user with an AWS IAM role. This lets ClickPipes connect to your Amazon {svc.name} {svc.resource} without storing database credentials.
      </p>

      <h4 id="enable-iam-authentication">Enable IAM authentication</h4>

      <ol>
        <li>Log in to your AWS account and go to the {svc.name} {svc.resource} you want to configure.</li>
        <li>Click <strong>Modify</strong>.</li>
        <li>Scroll to the <strong>Database authentication</strong> section.</li>
        <li>Select <strong>Password and IAM database authentication</strong>.</li>
        <li>Click <strong>Continue</strong>.</li>
        <li>Review the changes and select <strong>Apply immediately</strong>.</li>
      </ol>

      <h4 id="create-database-user">Create the ClickPipes user</h4>

      <p>Create the ClickPipes user with IAM authentication enabled, then grant it the same schema and replication privileges shown above:</p>

      <CodeBlock language="sql">{createUserSql}</CodeBlock>

      {children}

      <h4 id="obtaining-the-clickhouse-service-iam-role-arn">Obtain the ClickHouse service IAM role ARN</h4>

      <ol>
        <li>Log in to your ClickHouse Cloud account.</li>
        <li>Select the ClickHouse service you want to connect.</li>
        <li>Select the <strong>Settings</strong> tab.</li>
        <li>Scroll to the <strong>Network security information</strong> section at the bottom of the page.</li>
        <li>Copy the service's <strong>Service role ID (IAM)</strong> value, shown below.</li>
      </ol>

      <Frame>
        <img src="/images/cloud/security/secures3_arn.webp" alt="Service role ID (IAM) value in the Network security information section" />
      </Frame>

      <p>This value is your <code>{'{ClickHouse_IAM_ARN}'}</code> — the role ClickPipes uses to access your {svc.name} {svc.resource}.</p>

      <h4 id="obtaining-the-rds-resource-id">Obtain the resource ID</h4>

      <ol>
        <li>Log in to your AWS account and go to the {svc.name} {svc.resource} you want to configure.</li>
        <li>Select the <strong>Configuration</strong> tab.</li>
        <li>Note the <strong>Resource ID</strong> value — it looks like <code>{svc.id}</code>. This is your <code>{'{RDS_RESOURCE_ID}'}</code>, which you reference in the permissions policy.</li>
      </ol>

      <h4 id="manually-create-iam-role">Create the IAM role</h4>

      <ol>
        <li>Log in to your AWS account with an IAM user that has permission to create and manage IAM roles.</li>
        <li>Open the IAM console.</li>
        <li>
          Create a new IAM role with the following trust and permissions policies.

          <p>Trust policy (replace <code>{'{ClickHouse_IAM_ARN}'}</code> with the IAM role ARN of your ClickHouse instance):</p>

          <CodeBlock language="json">{`{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "{ClickHouse_IAM_ARN}"
      },
      "Action": [
        "sts:AssumeRole",
        "sts:TagSession"
      ]
    }
  ]
}`}</CodeBlock>

          <p>Permissions policy (replace <code>{'{RDS_RESOURCE_ID}'}</code> with the resource ID of your {svc.name} {svc.resource}, <code>{'{RDS_REGION}'}</code> with its region, and <code>{'{AWS_ACCOUNT}'}</code> with your AWS account ID):</p>

          <CodeBlock language="json">{`{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds-db:connect"
      ],
      "Resource": [
        "arn:aws:rds-db:{RDS_REGION}:{AWS_ACCOUNT}:dbuser:{RDS_RESOURCE_ID}/clickpipes_iam_user"
      ]
    }
  ]
}`}</CodeBlock>
        </li>
        <li>Once the role is created, copy its ARN. This is your <code>{'{RDS_ACCESS_IAM_ROLE_ARN}'}</code>.</li>
      </ol>

      <p>You can now use this IAM role to authenticate with your {svc.name} {svc.resource} from ClickPipes.</p>
    </>;
};

export const Image = ({img, alt, size = "lg"}) => {
  const normalizedSize = ["sm", "md", "lg"].includes(size) ? size : "lg";
  return <div className={`ch-image-${normalizedSize}`}>
      <Frame>
        <img src={img} alt={alt} />
      </Frame>
    </div>;
};

这是一份分步指南，说明如何配置您的 RDS MariaDB 实例，以便通过 MySQL ClickPipe 复制其中的数据。

<br />

<Info>
  我们还建议阅读[这里](/zh/integrations/clickpipes/mysql/faq)的 MySQL 常见问题页面。该页面正在持续更新。
</Info>

<div id="enable-binlog-retention-rds">
  ## 启用二进制日志保留
</div>

二进制日志是一组日志文件，其中包含对 MySQL 服务器实例所做的数据修改信息。复制需要二进制日志文件。必须同时执行以下两个步骤：

<Steps>
  <Step title="通过自动备份启用二进制日志记录" id="enable-binlog-logging-rds">
    MySQL 是否启用二进制日志记录由自动备份功能决定。可以在 AWS Console 中进行设置：

    <Image img="https://mintcdn.com/private-7c7dfe99-trino-dialect/ZEyvJTCdFXKmprnu/images/integrations/data-ingestion/clickpipes/mysql/source/rds/rds-backups.webp?fit=max&auto=format&n=ZEyvJTCdFXKmprnu&q=85&s=91cd44fb04281d38ec0b63f6a11a5a6c" alt="在 RDS 中启用自动备份" size="lg" border width="3230" height="530" data-path="images/integrations/data-ingestion/clickpipes/mysql/source/rds/rds-backups.webp" />

    建议根据复制用例将备份保留策略设置为足够长的时长。
  </Step>

  <Step title="Binlog 保留时长 (小时)" id="binlog-retention-hours-rds">
    Amazon RDS for MariaDB 设置 binlog 保留时长的方法有所不同。binlog 保留时长是指包含变更的二进制日志文件会保留多久。如果某些变更在 binlog 文件被删除前尚未被读取，复制将无法继续。binlog 保留时长 (小时) 的默认值为 NULL，表示不会保留二进制日志。

    要指定某个 DB 实例上二进制日志的保留小时数，请使用 `mysql.rds_set_configuration` 函数，并将 binlog 保留周期设置得足够长，以确保复制能够进行。建议的最短时长为 `24 hours`。

    ```text theme={null}
    mysql=> call mysql.rds_set_configuration('binlog retention hours', 24);
    ```
  </Step>
</Steps>

<div id="binlog-parameter-group-rds">
  ## 在参数组中配置 binlog 设置
</div>

在 RDS 控制台中点击你的 MariaDB 实例，然后进入 `Configurations` 选项卡，即可找到参数组。

<Image img="https://mintcdn.com/private-7c7dfe99-trino-dialect/zkBy8QRjLpx6BosZ/images/integrations/data-ingestion/clickpipes/mysql/parameter_group/rds_config.webp?fit=max&auto=format&n=zkBy8QRjLpx6BosZ&q=85&s=fea883549cd2426a9d14db24670c5ca5" alt="在 RDS 中查找参数组的位置" size="lg" border width="708" height="853" data-path="images/integrations/data-ingestion/clickpipes/mysql/parameter_group/rds_config.webp" />

点击参数组链接后，会进入其详情页面。你会在右上角看到一个 Edit 按钮：

<Image img="https://mintcdn.com/private-7c7dfe99-trino-dialect/zkBy8QRjLpx6BosZ/images/integrations/data-ingestion/clickpipes/mysql/parameter_group/edit_button.webp?fit=max&auto=format&n=zkBy8QRjLpx6BosZ&q=85&s=393ccec3725edf92a95cc15df8f00547" alt="编辑参数组" size="lg" border width="1662" height="292" data-path="images/integrations/data-ingestion/clickpipes/mysql/parameter_group/edit_button.webp" />

需要按如下方式设置 `binlog_format`、`binlog_row_metadata` 和 `binlog_row_image`：

1. 将 `binlog_format` 设置为 `ROW`。

<Image img="https://mintcdn.com/private-7c7dfe99-trino-dialect/zkBy8QRjLpx6BosZ/images/integrations/data-ingestion/clickpipes/mysql/parameter_group/binlog_format.webp?fit=max&auto=format&n=zkBy8QRjLpx6BosZ&q=85&s=c35f70d6504e3ba1886bd74feb009248" alt="将 Binlog 格式设为 ROW" size="lg" border width="960" height="232" data-path="images/integrations/data-ingestion/clickpipes/mysql/parameter_group/binlog_format.webp" />

2. 将 `binlog_row_metadata` 设置为 `FULL`

<Image img="https://mintcdn.com/private-7c7dfe99-trino-dialect/zkBy8QRjLpx6BosZ/images/integrations/data-ingestion/clickpipes/mysql/parameter_group/binlog_row_metadata.webp?fit=max&auto=format&n=zkBy8QRjLpx6BosZ&q=85&s=74a543105efd5e6b42a12fab01d9c15e" alt="将 Binlog 行元数据设为 FULL" size="lg" border width="934" height="234" data-path="images/integrations/data-ingestion/clickpipes/mysql/parameter_group/binlog_row_metadata.webp" />

3. 将 `binlog_row_image` 设置为 `FULL`

<Image img="https://mintcdn.com/private-7c7dfe99-trino-dialect/zkBy8QRjLpx6BosZ/images/integrations/data-ingestion/clickpipes/mysql/parameter_group/binlog_row_image.webp?fit=max&auto=format&n=zkBy8QRjLpx6BosZ&q=85&s=5a23b3c7c0e005345a59e49a0376d61b" alt="将 Binlog 行镜像设为 FULL" size="lg" border width="934" height="234" data-path="images/integrations/data-ingestion/clickpipes/mysql/parameter_group/binlog_row_image.webp" />

接下来，点击右上角的 `Save Changes`。这些更改可能需要重启实例后才会生效。如果你在 RDS 实例的 `Configurations` 选项卡中看到参数组链接旁显示 `Pending reboot`，通常就表示需要重启实例。

<br />

<Tip>
  如果你使用的是 MariaDB cluster，则上述参数应位于 [DB Cluster](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_WorkingWithParamGroups.CreatingCluster.html) parameter group 中，而不是 DB instance group 中。
</Tip>

<div id="gtid-mode-rds">
  ## 启用 GTID 模式
</div>

全局事务标识符 (GTID) 是分配给 MySQL/MariaDB 中每个已提交事务的唯一 ID。它可以简化 binlog 复制，并让故障排查更直接。MariaDB 默认启用 GTID 模式，因此无需用户执行任何操作即可使用。

<div id="configure-database-user-rds">
  ## 配置数据库用户
</div>

以管理员用户身份连接到您的 RDS MariaDB 实例，并执行以下命令：

1. 为 ClickPipes 创建一个专用用户：

   ```sql theme={null}
   CREATE USER 'clickpipes_user'@'host' IDENTIFIED BY 'some-password';
   ```

2. 授予 schema 权限。以下示例展示了 `mysql` database 的权限。对于您要复制的每个 database 和主机，请重复执行这些命令：

   ```sql theme={null}
   GRANT SELECT ON `mysql`.* TO 'clickpipes_user'@'host';
   ```

3. 向该用户授予复制权限：

   ```sql theme={null}
   GRANT REPLICATION CLIENT ON *.* TO 'clickpipes_user'@'%';
   GRANT REPLICATION SLAVE ON *.* TO 'clickpipes_user'@'%';
   ```

<div id="iam-authentication">
  ### 使用 IAM 身份验证 (可选)
</div>

<Note>
  AWS [在 10.6.5 版本中为 RDS for MariaDB 引入了 IAM 数据库身份验证](https://aws.amazon.com/blogs/database/iam-authentication-with-amazon-rds-for-mariadb/)。是否支持此功能取决于具体的引擎版本和 AWS 区域。使用此选项前，请先查看 [AWS 当前支持的区域和引擎版本](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.RDS_Fea_Regions_DB-eng.Feature.IamDatabaseAuthentication.html)。
</Note>

<IAMAuthentication engine="mysql" service="rds" />

<div id="configure-network-access">
  ## 配置网络访问
</div>

<div id="ip-based-access-control">
  ### 基于 IP 的访问控制
</div>

如果你想限制访问 RDS 实例的流量，请将[文档中列出的静态 NAT IP 地址](/zh/integrations/clickpipes/networking/static-ips)添加到 RDS 安全组 (Security Group) 的 `Inbound rules` 中。

<Image img="https://mintcdn.com/private-7c7dfe99-trino-dialect/ZEyvJTCdFXKmprnu/images/integrations/data-ingestion/clickpipes/mysql/source/rds/security-group-in-rds-mysql.webp?fit=max&auto=format&n=ZEyvJTCdFXKmprnu&q=85&s=ac44f969dafd1264c1f0f006477cc3b2" alt="在哪里可以找到 RDS 中的安全组（Security Group）？" size="lg" border width="2850" height="994" data-path="images/integrations/data-ingestion/clickpipes/mysql/source/rds/security-group-in-rds-mysql.webp" />

<Image img="https://mintcdn.com/private-7c7dfe99-trino-dialect/ZEyvJTCdFXKmprnu/images/integrations/data-ingestion/clickpipes/postgres/source/rds/edit_inbound_rules.webp?fit=max&auto=format&n=ZEyvJTCdFXKmprnu&q=85&s=7e5852a4a8a42c9a438075b917532273" alt="编辑上述安全组（Security Group）的入站规则" size="lg" border width="1800" height="935" data-path="images/integrations/data-ingestion/clickpipes/postgres/source/rds/edit_inbound_rules.webp" />

<div id="private-access-via-aws-privatelink">
  ### 通过 AWS PrivateLink 进行私网访问
</div>

要通过私网连接到您的 RDS 实例，您可以使用 AWS PrivateLink。请按照我们的 [ClickPipes 的 AWS PrivateLink 设置指南](/zh/resources/support-center/knowledge-base/cloud-services/aws-privatelink-setup-for-clickpipes) 配置连接。