Set up private network link to Amazon QuickSight

||Connect docs via MCP

Configure AWS PrivateLink so Atlan can reach your Amazon QuickSight account entirely over AWS's private network, without any metadata traffic crossing the public internet. Atlan manages the PrivateLink endpoint on your behalf—there is no customer-side Network Load Balancer or endpoint service to build. Your side of the setup is an IAM policy condition that permits only traffic originating from Atlan's endpoint.

For an overview of all private connectivity patterns, see Private network connectivity to your data sources.

Prerequisites

Before you begin, make sure you have:

• An Atlan Single Tenant SaaS deployment. Contact your Atlan representative if you are unsure.
• AWS account access to create and modify IAM policies and users—your AWS administrator may need to complete these steps.
• Atlan's VPC endpoint ID for QuickSight. Request it from Atlan support before starting.

Create IAM policy

1. Open the IAM console and go to Policies → Create policy.

2. Follow the Amazon QuickSight setup guide for the exact policy JSON granting the read-only QuickSight actions Atlan's connector needs.

3. Before saving the policy, add the following Condition block to each QuickSight statement to restrict access to Atlan's endpoint:

   "Condition": {
     "StringEquals": {
       "aws:SourceVpce": "<ATLAN_ENDPOINT_ID>"
     }
   }

   Replace <ATLAN_ENDPOINT_ID> with the endpoint ID provided by Atlan support.

4. Name the policy and click Create policy.

Create IAM user

1. In the IAM console, go to Users → Create user.
2. Enter a username and click Next.
3. On the Set permissions page, select Attach policies directly and attach the policy you created.
4. Click through to Create user.
5. Open the new user, go to Security credentials → Create access key.
6. Select Application running outside AWS, then click Next → Create access key.
7. Copy the Access key ID and Secret access key. These credentials are shown only once, so save them somewhere secure before closing.

You enter these credentials directly in Atlan's QuickSight connection form when you set up the connector; Atlan stores them encrypted.

Handle the access key securely

Enter the secret access key only in Atlan's connection form. Don't send it over email, chat, or a support ticket. Keep the IAM user scoped to the read-only policy described earlier, and rotate or revoke the key if it's ever exposed. Where your setup supports it, prefer short-lived or role-based credentials over a long-lived access key.

Next steps

Crawl Amazon QuickSight: Configure and run the crawler to extract metadata from QuickSight over this private path.