Skip to main content

Set up AWS private network link to Amazon Redshift

TL;DR

Connect Atlan to a private Amazon Redshift cluster over a Redshift-managed VPC endpoint, so traffic never crosses the public internet.

Connect

Connect Atlan to a private (not publicly accessible) Redshift cluster over a Redshift-managed VPC endpoint, so traffic never crosses the public internet. Six phases, each labeled with who performs it.

New to AWS networking?

Read How the private network link works first (5 minutes). It explains every term used below - VPC, managed endpoint, grantee account, cluster relocation.

Prerequisites - check these before opening any ticket​

  • Your cluster is an RA3 node type. DC2 clusters can't use managed VPC endpoints - use IP allowlisting or an agent instead.
  • Cluster relocation is turned on (cluster → Properties → Backup → Cluster relocation). An AWS requirement for managed endpoints.
  • The cluster is reachable on port 5439.
  • Your AWS account has spare VPC endpoint quota in the cluster's region.
  • Your Atlan tenant is a Single Tenant SaaS deployment. Different region - or a tenant on Azure/GCP? Supported; state it in your ticket (see cross-region & cross-cloud).

Six phases at glance​

PhaseWhat happensOwnerTypical time
1. RequestAsk Atlan for its AWS account ID and VPC IDAtlan User5 min to ask; reply in 1–2 business days
2. GrantAdd Atlan as a grantee account on your clusterAWS / Redshift admin10 minutes
3. NotifySend Atlan your AWS account ID + cluster identifierAtlan User5 minutes
4. BuildAtlan creates the Redshift-managed VPC endpointAtlan support1–2 business days
5. ReceiveAtlan replies with the private hostnameAtlan support-
6. Connect & verifyUse the private hostname in the crawler and testAtlan User30 minutes

Phase 1 - Request Atlan's identifiers​

Owner: Atlan User

Raise a support request from within Atlan with your tenant URL, and ask for:

  • Atlan's AWS account ID - the account you'll authorize as a grantee
  • Atlan's VPC ID - so the grant is scoped to Atlan's specific network, not the whole account

Mention your cluster's AWS region in the same message - if it differs from your tenant's region (or your tenant runs on Azure/GCP), Atlan needs to route the endpoint accordingly.

All Redshift values are tenant-specific

Atlan's AWS account ID, VPC ID, and public egress (NAT) IPs are provisioned per tenant and differ from tenant to tenant - none of them are published anywhere. A support ticket is the only way to get them, so ask for all the values you need in one ticket: account ID and VPC ID for the private link, plus NAT IPs if you also allowlist by IP anywhere. See the Atlan Network Details page for how tenant-specific values work across clouds.

Phase 2 - Grant Atlan access to cluster​

Owner: AWS / Redshift admin

  1. Sign in to the AWS console and open the Amazon Redshift console.
  2. Go to Clusters and select the cluster you want Atlan to crawl.
  3. Open the Properties tab and scroll to Granted accounts.
  4. Click Grant access. Enter Atlan's AWS account ID, choose Grant access to specific VPCs, and add Atlan's VPC ID.
  5. Confirm the grant.
Scope the grant to the VPC

Always choose Grant access to specific VPCs and enter Atlan's VPC ID, rather than granting the whole account. Same result for Atlan, smaller blast radius for you - and it's what your security review asks for.

Phase 3 - Send your cluster details to Atlan​

Owner: Atlan User

Reply on the same support ticket with:

  • Your AWS account ID (the account that owns the cluster)
  • The cluster identifier (its name in the Redshift console, not the full endpoint)

Phases 4–5 - Atlan builds endpoint and sends hostname​

Owner: Atlan support

Atlan creates a Redshift-managed VPC endpoint in its VPC targeting your cluster - possible only because of your Phase 2 grant. Within 1–2 business days, support replies with:

  • The private hostname to use in the crawler's Host Name field. It resolves only inside Atlan's network - nslookup from your laptop failing is expected, not a fault.
No approval handshake here

Unlike Snowflake private links, there is no "pending endpoint" you must approve afterwards - your Phase 2 grant was the approval. If the endpoint can't be created, the usual causes are the prerequisites: node type not RA3, cluster relocation off, or VPC endpoint quota exhausted. Support can tell you which.

Phase 6 - Connect and verify​

Owner: Atlan User

  1. In the crawler setup, enter the private hostname from Phase 5 in Host Name - this replaces the public endpoint from the AWS console.
  2. Port: 5439 (or your custom port).
  3. Using IAM user auth against a private provisioned cluster? Also fill in the optional Cluster ID field. Private Serverless? Fill in Workgroup.
  4. Enter credentials and click Test connection.

Success checklist​

  • Test connection passes
  • Preflight checks pass
  • A crawl scoped to one small schema completes
  • A full crawl or miner run completes
Adding another cluster later?

Each cluster needs its own grant and its own managed endpoint - an existing private link to one cluster doesn't cover a second one. Repeat Phases 2–5 per cluster (one ticket can carry several, clearly labeled). See Special cases.

Next steps​

Set up access and authentication: Create the database user and configure authentication so Atlan can connect over the private link.