Architecture Overview
EZ-CDC uses a distributed architecture with a clear separation between the control plane (managed by EZ-CDC) and the data plane (running in your cloud account — AWS or GCP).
High-Level Architecture
Components
Control Plane (EZ-CDC Managed)
The control plane runs in EZ-CDC's infrastructure and handles:
- Web Portal — User interface for managing deployments, datasources, and jobs
- API — Communication with workers and external integrations
- Job Orchestration — Background task processing, reconciliation, and maintenance
- Metadata Storage — Stores deployments, jobs, and encrypted connection configs
Data Plane (Your Cloud Account)
The data plane runs entirely in your cloud account (AWS or GCP):
| Component | Responsibility |
|---|---|
| Workers | Orchestrate CDC jobs, manage daemon lifecycle |
| dbmazz Daemons | Core CDC engine (one per active job) |
| Compute (EC2 / GCE) | Auto-scaling compute infrastructure |
| Private Connectivity | AWS PrivateLink or GCP Cloud NAT (optional, for enterprise) |
Data Flow
1. Job Creation
2. Job Assignment
Workers poll the control plane for pending jobs and receive assignments.
3. CDC Replication
4. Health Reporting
Workers continuously send heartbeat messages to the control plane to report health and status.
Communication Patterns
Pull-Based Model
All communication is initiated by workers (outbound from your VPC):
| Communication | Direction | Protocol | Port |
|---|---|---|---|
| Worker Registration | Worker → Control Plane | gRPC | 50051 |
| Heartbeat | Worker → Control Plane | gRPC | 50051 |
| Job Polling | Worker → Control Plane | gRPC | 50051 |
| Test Connection | Worker → Control Plane | HTTPS | 443 |
| Metrics Push | Worker → Control Plane | HTTP | 80 |
No inbound connections to your VPC are ever required.
Connectivity Options
| Mode | Cloud | Network Path | Use Case |
|---|---|---|---|
| Standard | AWS / GCP | Public internet (HTTPS/gRPC) | Most deployments |
| PrivateLink | AWS | AWS PrivateLink (private IPs) | Enterprise, regulated industries |
| Cloud NAT | GCP | No public IPs, egress via Cloud NAT | Private GCP deployments |
PrivateLink Architecture (AWS)
Deployment Topology
Single-Region Deployment
Workers, source databases, and sink databases all run within your cloud account and VPC, with workers making outbound connections to the EZ-CDC control plane.
Security Model
- Data stays in your VPC: Source and sink connections are direct, within your network
- Encrypted configs: Connection credentials are encrypted with AES-256-GCM
- No inbound access: Workers only make outbound connections
- IAM-based auth: Workers authenticate using deployment-specific tokens
- Optional PrivateLink: Eliminate public internet entirely
Next Steps
- BYOC Model - Deep dive into security benefits
- Quickstart - Deploy your first pipeline