Deploy for Production Readiness

 

Preparing your database environment for production use includes ensuring that you have a deployment that meets the availability requirements and security policies of your organization.  These may be unique to your organization.  This section provides resources for preparing your Neo4j environment to be ready for deployment.  

 

Neo4j is committed to assisting you to ensure that you are ready for deployment, as such, consider using our advisory services to adopt best practices.  Your Onboarding Manager can help you coordinate engagement with our technical experts:

 

Customer Success Advisory 

• Configuration Best practices

• Technical Health Check

• Pre-Go Live validation review

Professional Services

• Free estimate of customer specific services 

Aura Security

Review the Aura Security White Paper for a full overview of Aura security and options available to choose the right level of security for the project implementation.  

 

Options requiring customer configuration include Secure Connections, Single Sign-On and Customer Managed Encryption Keys.  Review the following procedures:

Secure Connection

AuraDB Virtual Dedicated Cloud and AuraDS Enterprise run in a dedicated AWS cloud account, Azure subscription, or GCP project to achieve complete isolation for your deployment. Additional Virtual Private Cloud (VPC) boundaries enable you to operate within an isolated section of the service, where your processing, networking, and storage are further protected. The Aura console resides in a separate VPC, isolated from the rest of the Aura services.

 

The Secure Connection documentation specifies how to configure a private connection in your cloud specific project.

Single Sign-On (SSO): 

Organization admins can configure organization level SSO (org SSO) and project level SSO (project SSO).

 

SSO is a log-in method and access, roles, and permissions are dictated by role-based access control (RBAC).

 

Org SSO: Allows org admins to restrict how users log in when they are trying to access the org. Access beyond log-in is managed via RBAC.

 

Project-level SSO: Impacts new database instances created within that project. It ensures users logging in with SSO have access to the database instances within the project. It depends on RBAC if the user can access and view or modify data within the database instances themselves. For this level, the role mapping may be used to grant users different levels of access based on a role in their identity provider (IdP). It does not give access to edit the project settings, for example to edit the project name, network access, or to edit the instance settings such as to rename an instance, or pause and resume.

 

The Single Sign-On documentation details how to configure SSO for your project.

Encryption and Customer Managed Keys (CMK):

All data stored in Neo4j Aura is encrypted using intra-cluster encryption between the various nodes comprising your instance and encrypted at rest using the underlying cloud provider’s encryption mechanism.

 

Aura always requires encrypted connections and ensures that clients validate server certificates when establishing a connection. This means that network traffic flowing to and from Neo4j Aura is always encrypted.

 

To protect data at rest, Aura uses encrypted data storage capabilities offered by the cloud providers. Whether customers choose to host in AWS, Azure, or GCP, each object store provides server-side encrypted buckets for data at rest encryption. By default, AWS, Azure, and GCP encrypt all backup buckets (including the objects stored inside) with AWS SSE-S3 encryption, Azure Storage Encryption (SSE), or Google-managed encryption. This ensures all your data stored in any one of these cloud providers uses 256-bit Advanced Encryption Standard (AES).

 

In addition to Aura’s default encryption for data at rest, Customer Managed Keys enable security-conscious enterprises to manage encryption keys through their Cloud Service Provider’s Key Management Services (KMS) on Aura, granting control over data protection and access management, including the ability to revoke access from Neo4j. This allows adherence to strict security policies alongside Aura’s default enterprise-grade security measures.

 

For more information refer to the encryption documentation.

Aura Console API

The Aura API allows you to programmatically perform actions on your Aura instances without the need to log in to the Console.  Most functions that are available in the UI can also be accessed through the API.  Refer to the Aura API documentation for details.

Aura Database Logging & Log Forwarding

In the Aura Console you can request Security and Query logs.  The log files are available to download from the Aura Console.  

 

In addition, you can set up Security Log forwarding.  However, Query Log forwarding is not currently available.

 

In the Aura Console you can use the Query Log Analyzer to review the queries executed on an Aura instance.  It allows you to better understand the performance of individual queries executed on the database.

 

You can optionally enable Change Data Capture (CDC) on Aura. Neo4j extracts CDC information from the transaction log. However, by default the transaction log does not contain information directly usable by CDC. For CDC to work, the transaction log needs to be enriched with further information. This is applied as an extra configuration option to each database. As soon as CDC is enabled, the database is ready to answer CDC queries.

 

Aura 10-point Go Live! Checklist

To prepare you for a production deployment on Aura, verify that you have completed the actions in this 10-point Go Live checklist.

1. Load test is recommended

   1. To measure TPS and concurrency handling

   2. To ensure the stability & performance of the application under normal and peak loads

   3. To establish SLA

2. Keep Neo4j informed on Go-Live dates so that we will have resources readily available for support

3. Review access controls and permissions

4. Periodically run data validation script to ensure data quality, integrity and completeness

5. Ensure production-specific implementations are in place (i.e., recommended to use neo4j+s scheme in production)

6. Ensure the Aura instance size is optimized for production workload

7. Perform technical health check with Neo4j Customer Success Architect

8. Test a restore process

9. Validate you are able to download/request query logs

10. Ensure you know how to access support portal and log a ticket

 

Installation & Configuration - Self-Managed

Review the Operations Manual for Installation to cover the topics:

• System requirements — The system requirements for a production deployment of Neo4j.

• Linux — Installation instructions for Linux.

• macOS — Installation instructions for macOS.

• Windows — Installation instructions for Windows.

• Neo4j Desktop — About Neo4j Desktop.

 

The neo4j.conf file is the main source of configuration settings in Neo4j and includes the mappings of configuration setting keys to values.  

 

Neo4j is a Database Management System, or DBMS, capable of managing multiple databases. The DBMS can manage a standalone server, or a group of servers in a cluster.  Review the Operations Manual for Database Administration that discusses how to manage Standard and Composite Databases.

 

Review the Operations Manual for how to set up the Neo4j Database Cluster.

 Additional Tools: Neo4j Admin, Neo4j CLI, Cypher Shell and more... 

 

Next Stage:  Operations & Security