Tableau Cloud Help

This topic explains how to set up Inbound Private Connect for a Tableau Cloud site.

Prerequisites

• Verify that your organization has enabled Inbound Private Connect. To check, log in to Tableau Cloud Manager, and select Settings. If you don't have the Private Connect tab, contact your account executive to enable Inbound Private Connect.
• Record the Tableau Cloud pod name. For example, if your site hostname is 10ay.online.tableau.com, the pod name is "10ay".
• Record the Tableau Cloud Manager (TCM) tenant name. For example, if your TCM URL is mytenant.cloudmanager.tableau.com, your tenant name is "mytenant".
• Record the Region common to both the Virtual Private Cloud (VPC) and Tableau Cloud pod. (Your AWS account must have a VPC in the same region as your Tableau Cloud pod.) See IP addresses for data provider authorization(Link opens in a new window) for a table with a list of pods and regions.
• Record the Endpoint Service Name for your pod's region. The Endpoint Service Name is in the AWS Regions, IAM ARNs, and Endpoint Service Names table on the Tableau Cloud Manager Private Connect page.
• The VPC must have Domain Name System (DNS) hostnames and DNS resolution enabled. For more information, see DNS attributes for your VPC(Link opens in a new window) in the AWS documentation.

Step 1: Create a VPC endpoint

Create an interface VPC endpoint in your AWS account that connects to the Tableau Cloud endpoint service. For more information, see Create a VPC endpoint(Link opens in a new window) in the AWS documentation.

1. Name tag (optional): Name the endpoint if desired.
2. Type: Select the Endpoint services that use NLBs and GWLBs category.
3. Service name: Use the Endpoint Service Name that you recorded in the prerequisites.
4. Select Verify service to proceed with setup.
5. Make sure that Enable Cross Region endpoint isn't checked.
6. VPC: Select your AWS VPC.
7. Subnets: Select subnets in at least two Availability Zones for high availability.
8. Make sure that Enable DNS Name isn't checked. (Configure private DNS manually in Step 5.)
9. Security group: Select an existing security group or create one. (Configure security groups in step 3.)
10. Select Create endpoint. The new endpoint status should be Pending acceptance.
11. Select the new endpoint to see Details.
12. Record the Endpoint ID. (Example: vpce-0123456789abcdef0)
13. Record the first entry in the list of DNS names. (Example: vpce-0123456789abcdef0-12345678.vpce-svc-0123456789abcdef0.us-west-2.vpce.amazonaws.com)

Step 2: Configure the endpoint in Tableau Cloud Manager

Configure the Tableau Cloud side of Private Connect.

1. Log in to TCM.
2. Select Settings > Private Connect.
3. Under Inbound Connections, select Create.
4. Provide a Name and Description for the inbound private connection.
5. Select the Region. The region matches the VPC region and Tableau pod region.
6. VPC Endpoint ID: Use the Endpoint ID that you recorded in step 1.
7. Select Create. The new endpoint status should be Allocating.
8. Provisioning can take a few minutes. In the actions menu (...) of the new private connection, click Sync to refresh the status.
9. The private connection is ready when the status is Ready in TCM and Available on the AWS Endpoints page. (Refresh the endpoint list with the refresh icon.)

Step 3: Configure security groups

Configure a rule on a AWS security group to allow traffic. For more information, see Control traffic to your AWS resources using security groups(Link opens in a new window) in the AWS documentation.

• Endpoint Security Group: Allow HTTPS to the VPC Endpoint.

Keep in mind that your particular network architecture may require other security group configurations.

After you successfully establish the connection and configure the security group, proceed to Steps 4 & 5 in DNS for Inbound Private Connect.