## Set up a private network link to Tableau server

URL: https://docs.atlan.com/apps/connectors/business-intelligence/tableau/how-tos/set-up-a-private-network-link-to-tableau-server

> As a prerequisite for TLS configuration on Tableau Server only, ensure that the health check _Protocol_ of the target group is set to **HTTPS** or [modify the health check settings](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html#modify-health-check-settings) as required.

[AWS PrivateLink](https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-privatelink.html) creates a secure, private connection between services running in AWS. This document describes the steps to set this up between Tableau server and Atlan, when you use our Single Tenant SaaS deployment.

:::warning Who can do this?
 You will need your AWS administrator involved - you may not have access to run these tasks yourself.

:::

## Prerequisites

You should already have the following:

- Tableau instance running in AWS (private EC2 instance).
- Atlan hosted in the same region as the Tableau instance.

:::info **Did you know?** 
 You will also need Atlan's AWS account ID later in this process. If you do not already have this, [request it now from support](https://docs.atlan.com/support/submit-request).

:::

## Setup network to EC2 instance

To setup the private network of your Tableau EC2 instance, from within [AWS](https://console.aws.amazon.com/):

### Copy network settings

To copy the network settings of your EC2 instance:

1. Navigate to **Services**, then **Compute**, then **EC2**.
2. On the left, under _Instances_, click **Instances**.
3. In the _Instances_ table, click on your Tableau EC2 instance.
4. Under the instance's _Details_ tab:
 1. Under _VPC ID_ copy the VPC identifier.
 2. Under _Subnet ID_ click the subnet for the instance.
 3. In the _Subnets_ table, copy the value under the _IPv4 CIDR_ column.

### Create inbound rule

To create an inbound rule allowing your private subnet access to your EC2 instance:

1. Navigate to **Services**, then **Compute**, then **EC2**.
2. On the left, under _Instances_, click **Instances**.
3. In the _Instances_ table, click on your Tableau EC2 instance.
4. Under the instance's details, change to the **Security** tab.
5. Under _Security groups_ click the security group for the instance.
6. Under the _Inbound rules_ tab, click the **Edit inbound rules** button.
7. At the bottom left of the _Inbound rules_ table, click the **Add rule** button.
 1. For _Type_, select **Custom TCP**.
 2. For _Port range_, enter the port on which Tableau is accessible (for example, default port **80** and TLS port **443**).
 3. For _Source_, choose **Custom** and enter the CIDR range for your Tableau instance (see [Copy network settings](#copy-network-settings)).
8. Below the bottom right of the _Inbound rules_ table, click the **Save rules** button.

## Create internal Network Load Balancer

### Start creating NLB

To create an NLB, from within AWS:

1. Navigate to **Services**, then **Compute**, then **EC2**.
2. On the left, under _Load Balancing_, click on **Load Balancers**.
3. At the top of the screen, click the **Create Load Balancer** button.
4. Under the _Network Load Balancer_ option, click the **Create** button.
5. Enter the following _Basic configuration_ settings for the load balancer:
 1. For _Load balancer name_ enter a unique name.
 2. For _Scheme_ select **Internal**.
 3. For _IP address type_ select **IPv4**.
6. Enter the following _Network mapping_ settings for the load balancer:
 1. For _VPC_ select the VPC where the Tableau instance is located (see [Copy network settings](#copy-network-settings)).
 2. For _Mappings_ select the availability zones with private subnets.
7. Enter the following _Listeners and routing_ settings for the load balancer:
 1. For _Port_ enter **80** (or the non-default port value used in [Created inbound rule](#create-inbound-rule)).
 2. For _Default action_ click the **Create target group** link. This will open the target group creation in a new browser tab.

### Create target group

To create a target group for the NLB:

1. Enter the following _Basic configuration_ settings for the target group:
 1. For _Choose target type_ select **Instances**.
 2. For _Target group name_ enter a name.
 3. For _Port_ enter **80** (or the non-default port value used in [Create inbound rule](#create-inbound-rule)).
 4. For _VPC_ select the VPC where the Tableau instance is located (see [Copy network settings](#copy-network-settings)).
 5. At the bottom of the form, click the **Next** button.
2. From the _Available instances_ table:
 1. Click the checkbox next to your Tableau instance.
 2. Enter the port for the instance (80 or non-default value used in steps above).
 3. Click the **Include as pending below** button.
3. At the bottom right of the form, click the **Create target group** button.

### Finish creating NLB

Return to the browser tab where you started the NLB creation, and continue:

1. Under _Listeners and routing_, click the refresh arrow to the far right of the _Default action_ drop-down box.
2. Select the target group you created above in the _Default action_ drop-down.
3. At the bottom right of the form click the **Create load balancer** button.
4. In the resulting screen, click the **View load balancer** button.

### Verify target group is healthy

:::warning

As a prerequisite for TLS configuration on Tableau Server only, ensure that the health check _Protocol_ of the target group is set to **HTTPS** or [modify the health check settings](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html#modify-health-check-settings) as required.

:::

To verify the target group is healthy:

1. From the EC2 menu on the left, under _Load Balancing_, click **Target Groups**.
2. From the _Target groups_ table, click the row for the target group you created above.
3. At the bottom of the screen, under the _Details_ tab, check that there is a 1 under both _Total targets_ and _Healthy_.

## Create endpoint service

To create an endpoint service, from within [AWS](https://console.aws.amazon.com/):

1. Navigate to **Services**, then **Networking & Content Delivery**, then **VPC**.
2. From the menu on the left, under _Virtual private cloud_ click **Endpoint services**.
3. At the top of the page, click the **Create endpoint service** button.
4. Enter the following _Endpoint service settings_:
 1. For _Name_ enter a meaningful name.
 2. For _Load balancer type_ choose **Network**.
5. For _Available load balancers_ select the load balancer you created above in [Create internal Network Load Balancer](#create-internal-network-load-balancer).
6. Enter the following _Additional settings_:
 1. For _Require acceptance for endpoint_ enable **Acceptance required**.
 2. For _Supported IP address types_ enable **IPv4**.
7. At the bottom right of the form, click the **Create** button.
8. Under the _Details_ of the endpoint service, copy the hostname under _Service name_.

## Allow Atlan account access

To allow Atlan's account access to the service, from within the endpoint service screen:

1. At the bottom of the screen, change to the **Allow principals** tab.
2. At the top of the _Allow principals_ table, click the **Allow principals** button.
3. Under _Principals to add_ and _ARN_ enter the Atlan account ID.
4. At the bottom right of the form, click the **Allow principals** button.

## Notify Atlan support

Once all the above steps are complete, [provide Atlan support](https://docs.atlan.com/support/submit-request) with the following information:

- The hostname for the endpoint service created above.
- The port number for the Tableau instance.
- For [SSL certificates](https://docs.atlan.com/llms/catalog/connector-capabilities/provide-ssl-certificates/llms.txt) only, the private DNS name for which you have issued an SSL certificate on your Tableau Server instance.

There are additional steps Atlan then needs to complete:

- Creating a security group.
- Creating an endpoint.
- For [SSL certificates](https://docs.atlan.com/llms/catalog/connector-capabilities/provide-ssl-certificates/llms.txt) only, creating a DNS CNAME record pointing the private DNS name shared above to the VPC endpoint URL. This will allow Atlan to use your private DNS name with the SSL certificate.

Once the Atlan team has confirmed the configuration is ready, please continue with the remaining steps.

## Accept the consumer connection request

To accept the consumer connection request, from within AWS:

1. Navigate to **Services**, then **Networking & Content Delivery**, then **VPC**.
2. From the menu on the left, under _Virtual private cloud_ click **Endpoint services**.
3. From the _Endpoint services_ table, select the endpoint service you created in [Create endpoint service](#create-endpoint-service).
4. At the bottom of the screen, change to the **Endpoint connections** tab.
 1. You should see a row in the _Endpoint connections_ table with a _State_ of _Pending_.
 2. Select this row, and click the **Actions** button and then **Accept endpoint connection request**.
 3. If prompted to confirm, type **accept** into the field and click the **Accept** button.
5. Wait for this to complete, it could take about 30 seconds.

😅 The connection is now established. You can now use the service endpoint provided by Atlan support (or the private DNS name for [SSL certificates](https://docs.atlan.com/llms/catalog/connector-capabilities/provide-ssl-certificates/llms.txt)) as the hostname to [crawl Tableau](https://docs.atlan.com/llms/connectors/tableau/crawl-tableau/llms.txt) in Atlan! 🎉

---