Inbound Private Connect
Inbound Private Connect for AWS allows organizations to create secure, private, and dedicated connections from their network directly to Tableau Cloud. By provisioning these connections on top of AWS PrivateLink, traffic between your environment and Tableau Cloud uses private IP address space and never traverses the public internet.
The private and secure nature of Inbound Private Connect can address a key requirement for working with your analytical data, helping you meet stringent data privacy and compliance regulations, such as GDPR, HIPAA, and CCPA.
Inbound Private Connect is available starting with Tableau Cloud 262, and requires a Tableau Cloud deployment with an Enterprise or Tableau+ license edition. Organizations purchase an add-on Private Connect Endpoint product for each private connection established.
Supported Interactions
After you create the private connection and configure DNS, users and API clients interact with Tableau Cloud normally, but traffic doesn't cross the public internet. Supported interactions include:
- Web browsers: Accessing Tableau Cloud sites and Tableau Cloud Manager (TCM).
- Tableau Desktop: Publishing workbooks and data sources.
- Tableau Bridge: Bridge clients connecting securely to a Tableau Cloud site.
- APIs: Tableau REST API, TCM REST API, and the Metadata API.
Note:
- Your AWS Virtual Private Cloud (VPC) your Tableau Cloud pod must be in the same region.
- Features like SCIM, Tableau ID authentication, TabGPT, and CloudFront static assets aren't supported and require standard internet routing.
Example Use Cases
Scenario 1: Avoid public internet for compliance
Your organization is in a highly regulated sector and must adhere to strict data privacy rules. Network security policy prevents user browser sessions and API calls from reaching Tableau Cloud over the public internet.
With Inbound Private Connect
Data travels securely and privately between your network edge and Tableau Cloud entirely over the AWS backbone.
Scenario 2: Complete network isolation
Your organization wants to make sure that external actors can't access your Tableau Cloud login page from the public web.
With Inbound Private Connect
You establish an inbound private connection and configure a Custom Domain for your Tableau Cloud site, hosted in a Private Hosted Zone within your VPC. Tableau blocks all access through the default public path-based URL, ensuring the site is exclusively accessible from within your private corporate network.
High-Level Setup Overview
Setting up Inbound Private Connect requires coordination between your AWS Administrator and your Tableau Cloud Administrator. The process involves:
- Creating an Interface VPC Endpoint in AWS targeting the Tableau service.
- Registering the Endpoint ID in Tableau Cloud Manager for approval.
- Configuring AWS Security Groups to allow HTTPS traffic.
- Creating Private Hosted Zones in AWS Route 53
- Creating DNS records in your Private Hosted Zones to securely route traffic through your Private Connect endpoint.
For more information, see: Setup Inbound Private Connect.