How do I create a private connection from Quick Sight to an Amazon Redshift cluster or an Amazon RDS DB instance that's in a private subnet?

Short description

Quick Sight supports Amazon Virtual Private Cloud (Amazon VPC) connections to AWS data sources. The Amazon VPC connection allows you to privately connect to an Amazon Redshift cluster or an RDS DB instance.

To create a private connection from Quick Sight, you must provide a subnet and security group from a VPC that's in the same AWS Region. Then, create a private connection from Quick Sight to the private subnet. After you establish the connection, you can allow traffic between the new security group and the Amazon Redshift cluster or RDS DB instance security group.

Note: The data source must be in the same AWS account and Region that you use for Quick Sight. Cross-Region and cross-account data sources require additional configuration. For more information, see How do I connect Quick Sight to a private Amazon RDS data source in a different AWS Region or AWS account?

Resolution

Important: The following resolution applies to Amazon Quick Suite Enterprise edition. To securely access data in private VPCs, it's a best practice to upgrade to Quick Suite Enterprise edition. For more information about Quick Suite Enterprise edition pricing, see Amazon Quick Sight pricing.

Review the prerequisites to configure the VPC in the Quick Suite console or the Quick Suite command line interface (CLI).

Add inbound and outbound rules to the Quick Sight security group

Complete the following steps:

1. Identify the ID of the subnet that Quick Sight uses to establish a private connection to your data source.
   Note: Each VPC connection must use at least two subnets. You can either use an existing subnet in the same VPC with a route to the database instance, or create a new subnet.
2. Create a new Quick Sight security group in the same VPC.
3. Add an inbound rule to the security group that allows all communication from the Amazon Redshift cluster or RDS DB instance.
4. For Type, choose All TCP.
5. For Source, choose Custom, and then enter the ID of the security group that your Amazon Redshift cluster or RDS DB instance uses.
6. Add an outbound rule to the Quick Sight security group that allows all traffic to the Amazon Redshift cluster or RDS DB instance.
7. For Type, choose Custom TCP Rule.
8. For Port Range, enter the port that the Amazon Redshift cluster or RDS DB instance uses. The default Amazon Redshift port is 5439. The default Amazon RDS port is 3306.
9. For Destination, choose Custom, and then enter the ID of the security group that your Amazon Redshift cluster or RDS DB instance uses.

Add inbound and outbound rules to the Amazon Redshift cluster or Amazon RDS security group

Complete the following steps:

1. In the cluster or DB instance's security group, add an inbound rule that allows all incoming traffic from the Quick Sight security group.
2. For Type, choose Custom TCP Rule.
3. For Port Range, enter the port that the Amazon Redshift cluster or RDS DB instance uses. The default Amazon Redshift port is 5439. The default Amazon RDS port is 3306.
4. For Source, choose Custom, and then enter the Quick Sight security group ID.
5. In the Amazon Redshift cluster or RDS DB instance's security group, add another outbound rule that allows all traffic to the Quick Sight security group.
6. For Type, choose All TCP.
7. For Destination, choose Custom, and then enter the Quick Sight security group ID.

Create a private connection from Quick Sight to Amazon VPC

Create a private connection from Quick Sight to Amazon VPC. Make sure to complete the prerequisites so that your AWS Identity and Access Management (IAM) execution role has the required permissions and trust policies.

Create a new dataset from the Amazon Redshift cluster or RDS DB instance

Complete the following steps:

1. Open the Quick Suite console, and then choose Datasets.
2. Choose New dataset.
3. Create a connection to an auto-discovered AWS data source. Choose the VPC connection type that you created.

Example Quick Sight SG-123345678f:

Inbound:

Type             Protocol          Port Range         Source                  Description------------------------------------------------------------------------------------------------------------------
All TCP           All              0 - 65535       sg-122887878f         Amazon RDS/Amazon Redshift security group

Outbound:

Type              Protocol          Port Range           Source                  Description------------------------------------------------------------------------------------------------------------
Custom TCP          TCP            5439 or 3306       sg-122887878f       Amazon RDS/Amazon Redshift security group

Example Amazon RDS or Amazon Redshift SG-122887878f:

Inbound:

Type             Protocol          Port Range           Source                Description-----------------------------------------------------------------------------------------------------
Custom TCP         TCP            5439 or 3306        sg-123345678f        Quick Sight security group

Outbound:

Type            Protocol          Port Range          Source                  Description-------------------------------------------------------------------------------------------------
All TCP           TCP             0 - 65535           sg-123345678f        Quick Sight security group

Related information

Configuring VPC connections in Amazon Quick Sight