Skip to content

Commit

Permalink
change tenant to project except for aws, gcp, azure tenants (#484)
Browse files Browse the repository at this point in the history
  • Loading branch information
AlexicaWright authored Oct 4, 2024
1 parent 207b79b commit e01fcbd
Show file tree
Hide file tree
Showing 10 changed files with 130 additions and 82 deletions.
6 changes: 3 additions & 3 deletions README.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ NOTE: The script requires Python 3.
1. Activate the virtual environment (if not already active): `source venv/bin/activate` (`venv\Scripts\activate` on Windows).
2. Run `python scripts/manage_instances.py --create INSTANCE_NAME` to create an Aura instance with name _INSTANCE_NAME_, or `python scripts/manage_instances.py --destroy INSTANCE_NAME` to destroy it.
- You can use the optional parameter `--instance-type` together with `--create` to select the instance type to create (the default is `enterprise-ds`).
- You can use different tenants using the optional parameter `--tenant` together with `--create` (the default is `gcp`). Every tenant is used with a default region.
- You can use different projects using the optional parameter `--project` together with `--create` (the default is `gcp`). Every project is used with a default region.
- Run `python scripts/manage_instances.py --help` for more details on the usage.

The script creates an _INSTANCE_NAME_.env file containing the Aura instance credentials.
Expand All @@ -39,7 +39,7 @@ The script creates an _INSTANCE_NAME_.env file containing the Aura instance cred

This script can be used to extract runnable code (Python or Cypher statements) from a doc HTML page. This means that the docset has to be built first, for example by running `npm run build`.

NOTE: The script requires Python 3.
NOTE: The script requires Python 3.

NOTE: AuraDS credentials must be available in an `aura.env` file.

Expand All @@ -58,7 +58,7 @@ NOTE: AuraDS credentials must be available in an `aura.env` file.

== Replace partials in an AsciiDoc file

Some applications cannot use Asciidoc files that use partials. The `replace_partials.py` script can be used to preprocess an Asciidoc file and replace the `include::partial` lines with the actual content of the referenced partials.
Some applications cannot use Asciidoc files that use partials. The `replace_partials.py` script can be used to preprocess an Asciidoc file and replace the `include::partial` lines with the actual content of the referenced partials.

NOTE: The script requires Python 3.

Expand Down
30 changes: 30 additions & 0 deletions modules/ROOT/images/process.svg
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
6 changes: 3 additions & 3 deletions modules/ROOT/pages/platform/api/authentication.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@ The Aura API uses OAuth 2.0 for API authentication.

[NOTE]
====
AuraDB Virtual Dedicated Cloud users, and AuraDS Enterprise users have unrestricted access to creating API credentials.
However, users with Free and Professional instances must have entered billing information or be a member of a marketplace tenant before they can create API credentials.
AuraDB Virtual Dedicated Cloud users, and AuraDS Enterprise users have unrestricted access to creating API credentials.
However, users with Free and Professional instances must have entered billing information or be a member of a marketplace project before they can create API credentials.
====

. Navigate to the https://console.neo4j.io/#account[Neo4j Aura Console Account Details page] in your browser.
Expand Down Expand Up @@ -74,7 +74,7 @@ Both the request and response contain sensitive information and must be kept sec
You are responsible for keeping the client credentials and access tokens confidential, whether in transit (by specifying HTTPS), if stored at rest, in log files, etc.
====

==== Request examples
==== Request examples

[.tabbed-example]
====
Expand Down
10 changes: 5 additions & 5 deletions modules/ROOT/pages/platform/consumption-report.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,13 @@

label:AuraDB-Virtual-Dedicated-Cloud[]

Virtual Dedicated Cloud services are offered through prepaid consumption plans.
Virtual Dedicated Cloud services are offered through prepaid consumption plans.
Billing is based on usage, with credits deducted from the available balance each month.

The consumption report, accessible in the Aura console’s Billing section, provides real-time insights into resource usage for the current tenant, including both running and paused states.
The consumption report, accessible in the Aura console’s Billing section, provides real-time insights into resource usage for the current project, including both running and paused states.
It displays RAM usage in GB-hours and the equivalent cost in prepaid credits.

Available to Admins, the report helps you track usage patterns over time and make informed resource allocation decisions.
Available to Admins, the report helps you track usage patterns over time and make informed resource allocation decisions.
Note that it includes primary database usage but **not** secondary database usage.

== Monitor consumption in real-time
Expand All @@ -21,7 +21,7 @@ The consumption report shows the billing status, which can be `running` meaning

=== Billing status

Billing status can be `ongoing` or `ended`.
Billing status can be `ongoing` or `ended`.

=== Usage (GB-hours)

Expand All @@ -32,7 +32,7 @@ The total usage for the selected period is displayed in GB-hours, along with the
== Filters

* Filter the usage data by predefined and custom date intervals.
* Look back for a period of up to 3 months.
* Look back for a period of up to 3 months.
* Filter by `Last 24 hours`, `Last 7 days`, `Last 30 days`, `Last 90 days` or a `Custom range`.

.Consumption report visual
Expand Down
2 changes: 1 addition & 1 deletion modules/ROOT/pages/platform/logging/log-forwarding.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ To access *Log forwarding*:
. Navigate to the https://console.neo4j.io/[Neo4j Aura Console] in your browser.
. Select *Log forwarding* from the sidebar menu.

This will display a list of currently configured log forwarding processes for the active tenant.
This will display a list of currently configured log forwarding processes for the active project.

If no log forwarding process is set up, a button to do so is displayed in the center of the page.

Expand Down
50 changes: 28 additions & 22 deletions modules/ROOT/pages/platform/metrics-integration.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -23,24 +23,24 @@ Analyzing the metrics data allows users to:
[aura-cmi-process-overview]
== Process overview

image::process.png[]
image::process.svg[]

[aura-cmi-steps]
== Detailed steps

. Log in to Aura as tenant admin.
. Log in to Aura as project admin.
. Make sure there is a dedicated Aura user to use for fetching metrics.
You can either:
** Create a new user:
... In https://console.neo4j.io/#user-management["User Management"^] of Neo4j Aura, invite a new user, selecting "Metrics Integration Reader" as a role.
image:invite_user.png[]
... Follow the invitation link and log in to Neo4j Aura.
... Confirm the tenant membership.
... Confirm the project membership.
** Or you can find an existing user in https://console.neo4j.io/#user-management["User Management"^] and change its role to "Metrics Integration Reader" +
+
[NOTE]
====
Capabilities of users with the role "Metrics Integration Reader" are limited to fetching the metrics and getting a read-only view of the tenant.
Capabilities of users with the role "Metrics Integration Reader" are limited to fetching the metrics and getting a read-only view of the project.
====
. Ensure you are logged in to Aura as the user selected in the previous step.
In https://console.neo4j.io/#account["Account Details"^], create new Aura API credentials.
Expand All @@ -58,20 +58,20 @@ Metrics for a Neo4j Aura instance are only returned if all the following are tru

* `Authorization` header of the metrics request contains a valid token.
* The token was issued for an Aura user with "Metrics Integration Reader" role.
* Tenant has instances of types `Enterprise (Virtual Dedicated Cloud)` or `Business Critical`.
* The specified instance belongs to the specified tenant.
* Project has instances of types `Enterprise (Virtual Dedicated Cloud)` or `Business Critical`.
* The specified instance belongs to the specified project.

[CAUTION]
====
The legacy term `Enterprise` is still used within the codebase and API.
However, in the Aura console and documentation, the AuraDB Enterprise tenant type is now known as AuraDB Virtual Dedicated Cloud.
The legacy term `Enterprise` is still used within the codebase and API.
However, in the Aura console and documentation, the AuraDB Enterprise project type is now known as AuraDB Virtual Dedicated Cloud.
====

[aura-cmi-revoke-access-to-metrics]
.Revoke access to metrics

To revoke a user's access to metrics of a specific tenant, remove the user from that tenant in https://console.neo4j.io/#user-management["User Management"^].
After that, the user still exists but its connection to the tenant is removed.
To revoke a user's access to metrics of a specific project, remove the user from that project in https://console.neo4j.io/#user-management["User Management"^].
After that, the user still exists but its connection to the project is removed.

[NOTE]
====
Expand Down Expand Up @@ -203,26 +203,32 @@ For details, see link:https://docs.datadoghq.com/agent/?tab=Linux[Datadog Agent
.Aura API for Metrics Integration

* Aura API supports fetching metrics integration endpoints using:
** endpoint `+/tenants/{tenantId}/metrics-integration+` (for tenant metrics)
** endpoint `+/tenants/{tenantId}/metrics-integration+` (for project metrics)
** JSON property `metrics_integration_url` as part of `+/instances/{instanceId}+` response (for instance metrics)
* Reference: link:https://neo4j.com/docs/aura/platform/api/specification/[Aura API Specification^]

[NOTE]
====
_Project_ replaces _Tenant_ in the console UI and documentation.
However, in the API, `tenant` remains the nomenclature.
====

[aura-cmi-cli-for-metrics-integration]
.Aura CLI for Metrics Integration

* Aura CLI has a subcommand for `tenants` command to fetch tenant metrics endpoint:
* Aura CLI has a subcommand for `tenants` command to fetch project metrics endpoint:
+
[source]
----
aura tenants get-metrics-integration --tenant-id <YOUR_TENANT_ID>
aura projects get-metrics-integration --tenant-id <YOUR_PROJECT_ID>
# example output
{
endpoint: "https://customer-metrics-api.neo4j.io/api/v1/<YOUR_TENANT_ID>/metrics"
endpoint: "https://customer-metrics-api.neo4j.io/api/v1/<YOUR_PROJECT_ID>/metrics"
}
# extract endpoint
aura tenants get-metrics-integration --tenant-id <YOUR_TENANT_ID> | jq '.endpoint'
aura projects get-metrics-integration --project-id <YOUR_PROJECT_ID> | jq '.endpoint'
----

* For instance metrics endpoint, Aura CLI `instances get` command JSON output includes a new property `metrics_integration_url`:
Expand All @@ -236,10 +242,10 @@ aura instances get --instance-id <YOUR_INSTANCE_ID>
"id": "id",
"name": "Production",
"status": "running",
"tenant_id": "YOUR_TENANT_ID",
"tenant_id": "YOUR_PROJECT_ID",
"cloud_provider": "gcp",
"connection_url": "YOUR_CONNECTION_URL",
"metrics_integration_url": "https://customer-metrics-api.neo4j.io/api/v1/<YOUR_TENANT_ID>/<YOUR_INSTANCE_ID>/metrics",
"metrics_integration_url": "https://customer-metrics-api.neo4j.io/api/v1/<YOUR_PROJECT_ID>/<YOUR_INSTANCE_ID>/metrics",
"region": "europe-west1",
"type": "enterprise-db",
"memory": "8GB",
Expand All @@ -257,20 +263,20 @@ aura instances get --instance-id <YOUR_INSTANCE_ID> | jq '.metrics_integration_u

The metrics returned by the integration endpoint are grouped based on the labels provided: `aggregation`, `instance_id`, and `database`.

An Aura instance typically runs on multiple servers to achieve availability and workload scalability.
These servers are deployed across different Cloud Provider availability zones in the user-selected region.
An Aura instance typically runs on multiple servers to achieve availability and workload scalability.
These servers are deployed across different Cloud Provider availability zones in the user-selected region.

Metrics Integration supports a more granular view of the Aura instance metrics with additional data points for availability zone & instance mode combinations.
Metrics Integration supports a more granular view of the Aura instance metrics with additional data points for availability zone & instance mode combinations.
This view can be enabled on demand.

[NOTE]
====
Contact link:https://support.neo4j.com/[Customer Support] to enable more granular metrics of instances for your tenant.
Contact link:https://support.neo4j.com/[Customer Support] to enable more granular metrics of instances for your project.
====

[NOTE]
====
There may be a delay in more granular metrics being available when a new Aura instance is created.
There may be a delay in more granular metrics being available when a new Aura instance is created.
This is because of the way 'availability zone' data is collected.
====

Expand Down
16 changes: 8 additions & 8 deletions modules/ROOT/pages/platform/security/secure-connections.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -15,26 +15,26 @@ The Aura Console runs in a separate VPC, separate from the rest of Aura.

== Network access

An Aura instance can be publicly available, completely private, or both.
An Aura instance can be publicly available, completely private, or both.
To configure this, you need to be authorized to access the part of the infrastructure that runs and handles these instances as well as the networking used to establish secure connections between the database and the application's VPC.
This includes the ability to connect over the cloud provider's private link and private endpoint.

If your Aura instances are public, traffic to them is allowed to traverse the public internet and they are accessible with the correct username and password.
If your Aura instances are public, traffic to them is allowed to traverse the public internet and they are accessible with the correct username and password.

For your instance to be completely private, turn public traffic off, use the cloud provider's network, and create a private endpoint inside your VPC, which gives you a private connection to Aura.
The only way to connect to your database is from inside your network (your VPC in your AWS/Azure/GCP account) using an internal IP address you choose and DNS records you create.
The only way to connect to your database is from inside your network (your VPC in your AWS/Azure/GCP account) using an internal IP address you choose and DNS records you create.

To select network access settings go to *Aura Console* > *Security* > *Network Access*.

== Private endpoints

Private endpoints are network interfaces inside your own VPC, which can only be accessed within your private network.
The cloud provider connects them over their network to Neo4j Aura.
Private endpoints are network interfaces inside your own VPC, which can only be accessed within your private network.
The cloud provider connects them over their network to Neo4j Aura.
By design they are not exposed to the public internet, ensuring that critical services are accessible only through private, secure networks.

A single private link connection applies to all instances in a region.
So if you've set one up for `us-east-1` then those network connections will apply to all instances in that region.
You can set up a second private link connection to applications that are hosted in a second region (for example `us-west-1`) but still housed inside the same Aura tenant.
A single private link connection applies to all instances in a region.
So if you've set one up for `us-east-1` then those network connections will apply to all instances in that region.
You can set up a second private link connection to applications that are hosted in a second region (for example `us-west-1`) but still housed inside the same Aura project.

=== AWS private endpoints

Expand Down
17 changes: 11 additions & 6 deletions modules/ROOT/pages/platform/security/single-sign-on.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,8 @@ label:AuraDB-Business-Critical[]

== SSO levels

Organization admins can configure organization level SSO (org SSO) and tenant level SSO (tenant SSO).
Organization admins can configure organization level SSO (org SSO) and project level SSO (project SSO).

SSO is a log-in method and access, roles, and permissions are dictated by role-based access control (RBAC).

* *Org SSO:* Allows org admins to restrict how users log in when they are trying to access the org.
Expand All @@ -20,6 +21,7 @@ It depends on RBAC if the user can access and view or modify data within the dat
For this level, the role mapping may be used to grant users different levels of access based on a role in their identity provider (IdP).
It *does not* give access to edit the project settings, for example to edit the project name, network access, or to edit the instance settings such as to rename an instance, or pause and resume.


=== SSO Org level roles

The following roles are available at the org level and these are assigned via invitation:
Expand Down Expand Up @@ -144,6 +146,7 @@ The following roles are available at the org level and these are assigned via in
|
|===


== Log-in methods

Log-in methods are different for each SSO level.
Expand All @@ -158,14 +161,14 @@ Administrators can configure a combination of one or more of the log-in methods.

An organization's administrator can add Aura as a log-in from a tile in an organization's Apps Dashboard.

*Tenant SSO supports:*
*Project SSO supports:*

* User/password
* Okta
* Microsoft Entra ID

However, at the tenant level you cannot disable user/password,
but at the org level you can disable email/password and Google SSO as long as you have at least one other custom SSO provider configured.

However, at the project level you cannot disable user/password, but at the org level you can disable email/password and Google SSO as long as you have at least one other custom SSO provider configured.

== Setup requirements

Expand All @@ -188,6 +191,8 @@ Support can assist with:

If you require support assistance, visit link:https://support.neo4j.com/[Customer Support] and raise a support ticket including the following information:

. The _Tenant ID_ of the tenants you want to use SSO for.
See xref:platform/user-management.adoc#_tenants[Tenants] for more information on how to find your __Tenant ID__.

. The _Project ID_ of the projects you want to use SSO for.
See xref:platform/user-management.adoc#_projects[Projects] for more information on how to find your __Project ID__.

. The name of your IdP
Loading

0 comments on commit e01fcbd

Please sign in to comment.