Tableau Cloud Help

This topic explains how to set up DNS for Inbound Private Connect. Set up the connection and security groups first. For more information, see Steps 1, 2, & 3 in Setup Inbound Private Connect.

Step 4: Create private hosted DNS zones

A Private Hosted DNS Zone in your VPC ensures that your Tableau Cloud traffic routes through the VPC endpoint instead of the public internet. For more information, see Working with Private Hosted Zones and Creating a private hosted zone in the AWS documentation.

Create Private Hosted Zones for:

1. cloudmanager.tableau.com
   
2. {pod_name}.online.tableau.com
{pod_name} is the Tableau Cloud pod name you recorded during the Setup Inbound Private Connect prerequisites.
3. bridge-{pod_name}.online.tableau.com
{pod_name} is the Tableau Cloud pod name you recorded during the Setup Inbound Private Connect prerequisites.
4. sso.online.tableau.com

When creating each zone:

• For Domain name, enter the private hosted zone (domain) you're creating. (Zone #2 example: 10ay.online.tableau.com)
• For Type, select Private hosted zone.
• In the VPC ID list, select the VPC that you want to associate with the hosted zone.

Step 5: Create DNS records in the private zones

Add DNS records that point Tableau Cloud hostnames to the VPC endpoint. For more information, see Creating records by using the Amazon Route 53 console(Link opens in a new window) in the AWS documentation.

DNS records common to all 4 zones

Create the following DNS records in each of the private hosted zones from Step 4:

• (Leave Record name blank)
• Record type: A
• Enable the Alias toggle.
• Route traffic to: Select Alias to VPC endpoint.
• Select the VPC Endpoint's region.
• Search for and select the VPC endpoint DNS Name you recorded at the end of Setup Inbound Private Connect Step 1.
• Routing Policy: Select Simple routing.
• Evaluate target health: Leave as No.
• Select Create records.

Repeat the process for each remaining private hosted zones from Step 4.

Additional DNS record for cloudmanager.tableau.com

Create one additional DNS record in the cloudmanager.tableau.com zone:

• Record Name: *
  The asterisk is a wildcard that will match any host in the cloudmanager.tableau.com domain.
• Record type: A
• Enable the Alias toggle.
• Route traffic to: Select Alias to VPC endpoint.
• Select the VPC Endpoint's region.
• Search for and select the VPC endpoint DNS Name you recorded at the end of Setup Inbound Private Connect Step 1.
• Routing Policy: Select Simple routing.
• Evaluate target health: Leave as No.
• Select Create records.

Once the DNS records have had a chance to propagate, test your connectivity by logging into Tableau Cloud from a host within your VPC.

DNS Considerations

• Inbound Private Connect will not fail over if you use a disaster-recovery region with your Tableau Cloud pod.
• For hosts inside the VPC, private hosted zones take precedence over public zones with the same name. Only the records in the private hosted zone will resolve.
• If users in the VPC need to reach Tableau Cloud sites on other pods through the public hostname, plan an alternate DNS strategy before you create the private hosted zone. For help choosing an approach, contact your account team.