Your data’s security is important. To ensure a secure two-way data exchange between your cloud data warehouse and the ThoughtSpot Cloud tenant, you can use an AWS PrivateLink. This option is currently available for your Snowflake or Redshift data warehouse connections. This article details how to enable a PrivateLink for Redshift; you can also enable it for Snowflake.
To deploy an AWS PrivateLink, you must work with ThoughtSpot Support and follow the procedure in this article.
Prerequisites
- You must have a Redshift account
- The ThoughtSpot cluster must be in the same AWS region as your Redshift account
- You must obtain the ThoughtSpot AWS Account Amazon Resource Name (ARN) from ThoughtSpot Support. You may need a separate ARN for staging or dev environments.
Enable an AWS PrivateLink for Redshift
To deploy an AWS PrivateLink between your Redshift data warehouse and the ThoughtSpot Cloud tenant, follow these steps.
Configure the Endpoint Service in your AWS Console
After completing the prerequisites, you must configure the Endpoint Service.
-
Log into the AWS Console.
-
Create a Network Load Balancer (NLB) routing TCP traffic on port 5439 to your Redshift database.
-
Navigate to AWS VPC Console > Endpoint Services > Create Endpoint Service.
-
Select the Redshift NLB you created in step 2.
-
Select Require Acceptance for Endpoint.
-
Select Endpoint Service > Whitelist principles > Add principles to whitelist. Add the ThoughtSpot AWS Account Amazon Resource Name (ARN) that you obtained from ThoughtSpot Support in the prerequisites. You may need a separate ARN for staging or dev environments.
-
Select Endpoint Service.
-
Write down the values for:
-
Service name: for example, com.amazonaws.vpce.us-west-2.vpce-svc-0123456789abcdef
-
Availability zones: for example, us-west-2a (usw2-az1)
You must provide the service name and availability zones to ThoughtSpot Support.
Exchange AWS and ThoughtSpot information with ThoughtSpot Support
-
Send the Service name and Availability zones you gathered in step 8 of Configure the Endpoint Service in your AWS Console to ThoughtSpot Support.
-
After ThoughtSpot Support configures the AWS PrivateLink in ThoughtSpot, ask them to send you the PrivateLink Endpoint DNS name.
Accept the PrivateLink Request
-
Navigate to VPC > Endpoint Services.
-
Select the Endpoint Service you created in Configure the Endpoint Service in your AWS Console.
-
Select Endpoint Connections.
-
Select the connection from the ThoughtSpot AWS Account. Its status should be Pending Acceptance.
-
Select Actions > Accept endpoint connection request.
Configure Connections
Configure Connections for Redshift, using the PrivateLink Endpoint DNS name from ThoughtSpot Support.