How to set up a private network link to Tableau

AWS PrivateLink creates a secure, private connection between services running in AWS. This document describes the steps to set this up between Tableau and Atlan, when you use our Single Tenant SaaS deployment.

Prerequisites

You should already have the following:

• Tableau instance running in AWS (private EC2 instance).
• Atlan hosted in the same region as the Tableau instance.

Setup network to EC2 instance

To setup the private network of your Tableau EC2 instance, from within AWS:

Copy network settings

To copy the network settings of your EC2 instance:

1. Navigate to Services, then Compute, then EC2.
2. On the left, under Instances, click Instances.
3. In the Instances table, click on your Tableau EC2 instance.
4. Under the instance's Details tab:
   1. Under VPC ID copy the VPC identifier.
   2. Under Subnet ID click the subnet for the instance.
   3. In the Subnets table, copy the value under the IPv4 CIDR column.

Create inbound rule

To create an inbound rule allowing your private subnet access to your EC2 instance:

1. Navigate to Services, then Compute, then EC2.
2. On the left, under Instances, click Instances.
3. In the Instances table, click on your Tableau EC2 instance.
4. Under the instance's details, change to the Security tab.
5. Under Security groups click the security group for the instance.
6. Under the Inbound rules tab, click the Edit inbound rules button.
7. At the bottom left of the Inbound rules table, click the Add rule button.
   1. For Type, select Custom TCP.
   2. For Port range, enter the port on which Tableau is accessible (for example, default port 80 and TLS port 443).
   3. For Source, choose Custom and enter the CIDR range for your Tableau instance (see Copy network settings).
8. Below the bottom right of the Inbound rules table, click the Save rules button.

Create internal Network Load Balancer

Start creating NLB

To create an NLB, from within AWS:

1. Navigate to Services, then Compute, then EC2.
2. On the left, under Load Balancing, click on Load Balancers.
3. At the top of the screen, click the Create Load Balancer button.
4. Under the Network Load Balancer option, click the Create button.
5. Enter the following Basic configuration settings for the load balancer:
   1. For Load balancer name enter a unique name.
   2. For Scheme select Internal.
   3. For IP address type select IPv4.
6. Enter the following Network mapping settings for the load balancer:
   1. For VPC select the VPC where the Tableau instance is located (see Copy network settings).
   2. For Mappings select the availability zones with private subnets.
7. Enter the following Listeners and routing settings for the load balancer:
   1. For Port enter 80 (or the non-default port value used in Created inbound rule).
   2. For Default action click the Create target group link. This will open the target group creation in a new browser tab.

Create target group

To create a target group for the NLB:

1. Enter the following Basic configuration settings for the target group:
   1. For Choose target type select Instances.
   2. For Target group name enter a name.
   3. For Port enter 80 (or the non-default port value used in Create inbound rule).
   4. For VPC select the VPC where the Tableau instance is located (see Copy network settings).
   5. At the bottom of the form, click the Next button.
2. From the Available instances table:
   1. Click the checkbox next to your Tableau instance.
   2. Enter the port for the instance (80 or non-default value used in steps above).
   3. Click the Include as pending below button.
3. At the bottom right of the form, click the Create target group button.

Finish creating NLB

Return to the browser tab where you started the NLB creation, and continue:

1. Under Listeners and routing, click the refresh arrow to the far right of the Default action drop-down box.
2. Select the target group you created above in the Default action drop-down.
3. At the bottom right of the form click the Create load balancer button.
4. In the resulting screen, click the View load balancer button.

Verify target group is healthy

To verify the target group is healthy:

1. From the EC2 menu on the left, under Load Balancing, click Target Groups.
2. From the Target groups table, click the row for the target group you created above.
3. At the bottom of the screen, under the Details tab, check that there is a 1 under both Total targets and Healthy.

Create endpoint service

To create an endpoint service, from within AWS:

1. Navigate to Services, then Networking & Content Delivery, then VPC.
2. From the menu on the left, under Virtual private cloud click Endpoint services.
3. At the top of the page, click the Create endpoint service button.
4. Enter the following Endpoint service settings:
   1. For Name enter a meaningful name.
   2. For Load balancer type choose Network.
5. For Available load balancers select the load balancer you created above in Create internal Network Load Balancer.
6. Enter the following Additional settings:
   1. For Require acceptance for endpoint enable Acceptance required.
   2. For Supported IP address types enable IPv4.
7. At the bottom right of the form, click the Create button.
8. Under the Details of the endpoint service, copy the hostname under Service name.

Allow Atlan account access

To allow Atlan's account access to the service, from within the endpoint service screen:

1. At the bottom of the screen, change to the Allow principals tab.
2. At the top of the Allow principals table, click the Allow principals button.
3. Under Principals to add and ARN enter the Atlan account ID.
4. At the bottom right of the form, click the Allow principals button.

Notify Atlan support

Once all the above steps are complete, provide Atlan support with the following information:

• The hostname for the endpoint service created above.
• The port number for the Tableau instance.
• For SSL certificates only, the private DNS name for which you have issued an SSL certificate on your Tableau Server instance.

There are additional steps Atlan then needs to complete:

• Creating a security group.
• Creating an endpoint.
• For SSL certificates only, creating a DNS CNAME record pointing the private DNS name shared above to the VPC endpoint URL. This will allow Atlan to use your private DNS name with the SSL certificate.

Once the Atlan team has confirmed the configuration is ready, please continue with the remaining steps.

Accept the consumer connection request

To accept the consumer connection request, from within AWS:

1. Navigate to Services, then Networking & Content Delivery, then VPC.
2. From the menu on the left, under Virtual private cloud click Endpoint services.
3. From the Endpoint services table, select the endpoint service you created in Create endpoint service.
4. At the bottom of the screen, change to the Endpoint connections tab.
   1. You should see a row in the Endpoint connections table with a State of Pending.
   2. Select this row, and click the Actions button and then Accept endpoint connection request.
   3. If prompted to confirm, type accept into the field and click the Accept button.
5. Wait for this to complete, it could take about 30 seconds.

😅 The connection is now established. You can now use the service endpoint provided by Atlan support (or the private DNS name for SSL certificates) as the hostname to crawl Tableau in Atlan! 🎉