## Set up private network link to Amazon QuickSight

URL: https://docs.atlan.com/apps/connectors/business-intelligence/amazon-quicksight/how-tos/set-up-a-private-network-link-to-amazon-quicksight

> Configure AWS PrivateLink so Atlan can reach your QuickSight account without traffic crossing the public internet.

Configure [AWS PrivateLink](https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-privatelink.html) so Atlan can reach your Amazon QuickSight account entirely over AWS's private network, without any metadata traffic crossing the public internet. Atlan manages the PrivateLink endpoint on your behalf—there is no customer-side Network Load Balancer or endpoint service to build. Your side of the setup is an IAM policy condition that permits only traffic originating from Atlan's endpoint.

For an overview of all private connectivity patterns, see [Private network connectivity to your data sources](https://docs.atlan.com/llms/governance/administration/private-connectivity/llms.txt).

## Prerequisites

Before you begin, make sure you have:

- An Atlan **Single Tenant SaaS** deployment. Contact your Atlan representative if you are unsure.
- AWS account access to create and modify IAM policies and users—your AWS administrator may need to complete these steps.
- Atlan's VPC endpoint ID for QuickSight. [Request it from Atlan support](https://docs.atlan.com/support/submit-request) before starting.

## Create IAM policy

1. Open the [IAM console](https://console.aws.amazon.com/iam/) and go to **Policies** → **Create policy**.
2. Follow the [Amazon QuickSight setup guide](https://docs.atlan.com/llms/connectors/amazon-quicksight/set-up-amazon-quicksight/llms.txt) for the exact policy JSON granting the read-only QuickSight actions Atlan's connector needs.
3. Before saving the policy, add the following `Condition` block to each QuickSight statement to restrict access to Atlan's endpoint:

 ```json
 "Condition": {
 "StringEquals": {
 "aws:SourceVpce": ""
 }
 }
 ```

 Replace `` with the endpoint ID provided by Atlan support.

4. Name the policy and click **Create policy**.

## Create IAM user

1. In the IAM console, go to **Users** → **Create user**.
2. Enter a username and click **Next**.
3. On the **Set permissions** page, select **Attach policies directly** and attach the policy you created.
4. Click through to **Create user**.
5. Open the new user, go to **Security credentials** → **Create access key**.
6. Select **Application running outside AWS**, then click **Next** → **Create access key**.
7. Copy the **Access key ID** and **Secret access key**. These credentials are shown only once, so save them somewhere secure before closing.

You enter these credentials directly in Atlan's QuickSight connection form when you [set up the connector](https://docs.atlan.com/llms/connectors/amazon-quicksight/set-up-amazon-quicksight/llms.txt); Atlan stores them encrypted.

:::caution Handle the access key securely
Enter the secret access key only in Atlan's connection form. Don't send it over email, chat, or a support ticket. Keep the IAM user scoped to the read-only policy described earlier, and rotate or revoke the key if it's ever exposed. Where your setup supports it, prefer short-lived or role-based credentials over a long-lived access key.
:::

## Next steps

[Crawl Amazon QuickSight](https://docs.atlan.com/llms/connectors/amazon-quicksight/crawl-amazon-quicksight/llms.txt): Configure and run the crawler to extract metadata from QuickSight over this private path.

---