Network Connectivity Glossary
TL;DR
Definitions of the connectivity and identity terms used across Atlan's connector setup guides—endpoints, endpoint services, CIDR ranges, service principals, tenant settings, and more.
This page defines the terms used across Atlan's private connectivity guides, such as the AWS and Azure private network link guides for Snowflake. It also covers the identity terms used by API-based connectors such as Microsoft Power BI.
| Term | What it means |
|---|---|
| Endpoint (private endpoint) | The "plug" - a private network address inside Atlan's network that forwards traffic to your Snowflake service. Atlan creates and owns it. |
| Endpoint service / Private Link service | The "socket" - the thing Snowflake exposes for private connections. Snowflake creates it when Private Link is enabled on your account. |
privatelink-vpce-id | The AWS name of the socket (VPCE = "VPC endpoint"). Only exists for AWS-hosted Snowflake. If your config output has no vpce-id, your Snowflake is on Azure - use the Azure guide. |
privatelink-pls-id | The Azure name of the socket (PLS = "Private Link service"). Only exists for Azure-hosted Snowflake. |
| Resource ID | Azure's full path-like name for any object (starts /subscriptions/…). Atlan sends you the Resource ID of the endpoint it created so you can approve exactly that one. |
| Azure token | A short-lived proof-of-identity string Atlan generates alongside the endpoint. Snowflake requires it in the approval command so only the endpoint's real owner can be authorized. It expires - if approval fails with a token error, ask Atlan support for a fresh one. |
| OCSP URL | The address used to check that TLS certificates haven't been revoked. It must also resolve over the private path, which is why the guides collect it. You never configure it yourself - Atlan does. |
| Regionless vs regional URL | Snowflake accounts have two hostname styles (org-account.privatelink… vs account.region.privatelink…). Share both if present; Atlan tells you which to use in the crawler. |
| Network policy / network rule | Snowflake's firewall: a list of IPs, CIDR ranges, or endpoint IDs allowed to connect. If you use one, it needs an Atlan entry - see the private network link guides. |
| NAT IP | The fixed public IP address your Atlan tenant's outbound traffic appears from when not using a private link. |
| CIDR range | Shorthand for a block of IP addresses, for example 10.20.0.0/17 = all addresses from 10.20.0.0 to 10.20.127.255. Allowlist the whole published block - a partial range causes intermittent failures. |
| Workspace URL | The hostname you open in a browser - your-ws.cloud.databricks.com (AWS) or adb-1234567890123456.7.azuredatabricks.net (Azure). This is also what you enter as the host in the Atlan connection: the URL doesn't change when you move to Private Link - only where it resolves to. |
| Workspace ID | The long number identifying a Databricks workspace - after ?o= in the URL, or in the Account Console. Atlan asks for it to disambiguate multi-workspace setups. |
| VPC endpoint service name | The AWS name of the socket, in the form com.amazonaws.vpce.<region>.vpce-svc-xxxxxxxxxxxxxxxxx. Found in the Databricks Account Console under Cloud resources → Network. Only exists for AWS-hosted workspaces. |
| VPCE ID | The ID of the endpoint (plug) Atlan creates, like vpce-0a1b2c3d4e5f6a7b8. You register this ID in your Databricks Account Console when approving the connection. |
| Private Access Settings (PAS) | The Databricks object that turns front-end Private Link on for a workspace and decides whether public access stays open alongside it. Owned by your Databricks account admin. |
databricks_ui_api | The Azure "group ID" (sub-target) Atlan's private endpoint connects to - it means "the workspace's web UI and REST API front end." |
| Private DNS mapping | The record inside Atlan's network that makes your workspace URL resolve to the private endpoint (a private hosted zone on AWS; the privatelink.azuredatabricks.net zone on Azure). Atlan creates and maintains it - one mapping per workspace hostname. |
| IP access list | Databricks' IP firewall for a workspace (Workspace settings → Security → IP access lists). If enabled, it must permit whatever path Atlan arrives on - public egress IPs or the private range. |
| NSG (network security group) | Azure's subnet-level firewall. The NSG in front of your Private Link path must permit Atlan's tenant CIDR range on port 443 - approval alone doesn't open it. |
| Serverless egress IPs | The outbound addresses used when Databricks calls out to external services (like Atlan's MCP endpoint). These belong to Databricks' serverless compute plane - not your cluster's NAT IP - and your team may need Databricks support to enumerate them. |
| App registration (Power BI) | The identity you create in Microsoft Entra ID for Atlan, like a machine user account. Has a client ID and a secret. |
| Service principal (SP) | The runtime object created from an app registration; in the Azure portal it appears as an Enterprise Application. This is what you add to security groups and Power BI workspaces. |
| Client secret - Value vs Secret ID | The Value is the password (shown once at creation); the Secret ID is just a label. Pasting the Secret ID into Atlan is a common Power BI setup error (AADSTS7000215). |
| Tenant settings (Power BI) | Power BI admin-portal switches that decide which API families service principals may call. The Power BI connector needs four, each scoped to a security group. |
| Admin APIs vs Fabric public APIs | Two separate Power BI API families with separate tenant settings. Admin (read-only) APIs list everything tenant-wide; Fabric public APIs read workspace-scoped detail (report pages, dataset parameters). Neither setting includes the other. |
| Scanner API mode | A Power BI crawler toggle that reads through tenant-level admin APIs instead of workspace membership. Less setup, less detail (no report pages, degraded measure lineage). |
| Preflight checks | Atlan's pre-crawl validation of credentials, permissions, and configuration. A preflight failure doesn't always mean the crawl fails. |
| Allowlisting (Atlan side) | For AWS role delegation: Atlan support attaches a policy to your tenant's node instance role permitting it to assume your specific role ARN. Without this, assumption fails even if your trust policy is perfect. |
| Catalog ID (AWS Glue) | An identifier for a federated Glue catalog (for example Amazon S3 Table Buckets). Only needed in those setups. |
| Circuit breaker | Atlan's safety mechanism: if a crawl deletes more than 80% of previously cataloged assets, the workflow stops instead of publishing. It protects your catalog when the source suddenly returns much less data. |
| API token (dbt Cloud) | A long secret string that proves to dbt Cloud that the caller is allowed in - like a password issued for machines. Atlan stores it encrypted and sends it with every API call. |
| Service account token vs PAT (dbt Cloud) | Two kinds of dbt Cloud token. A service account token belongs to your dbt account (recommended - survives people leaving). A PAT belongs to one person's user. |
| Access URL (dbt Cloud) | The web address of your dbt Cloud instance. Multi-tenant accounts use https://cloud.getdbt.com; regional or single-tenant accounts have their own. Never use a URL containing metadata. - that's a different API. |
| IP restrictions (dbt Cloud) | An optional dbt Cloud security setting that rejects logins and API calls from unknown network addresses. If enabled, Atlan's NAT IP must be added to its allowlist or every Atlan call is rejected - regardless of how good the token is. |
| Bucket / prefix | A bucket is a cloud storage container (like a shared drive); a prefix is a folder path inside it. Enter the bucket's plain name - no s3:// in front. |
dbt artifacts (manifest.json / run_results.json / catalog.json) | Files dbt writes each run. manifest.json describes your models and is required; run_results.json adds test outcomes; catalog.json adds column details (produced by dbt docs generate). |
| Connection admin | The Atlan role that may edit a connection and its credentials. Being a workflow admin isn't the same thing. |
| IAM | AWS's Identity and Access Management - the system that controls who (users, roles) can do what (policies) in an AWS account. |
| IAM user + access keys | A permanent AWS identity with a long-lived key pair (access key ID + secret access key). Simple, but the keys must be stored in Atlan and rotated by you. |
| IAM role | An AWS identity with permissions but no password. Other identities "assume" it to borrow its permissions temporarily. |
| Trust policy | The rule on an IAM role saying who may assume it. For Atlan, it must name your tenant's node instance role ARN. |
| Node instance role | The AWS role Atlan's crawler infrastructure runs as - the identity that shows up at your "front desk." Its ARN is specific to your Atlan tenant and comes from Atlan support. Not published anywhere. |
| External ID | An extra shared secret in the role-trust handshake. Atlan generates it in the connection form; you paste it into the trust policy. Both sides must match character-for-character - a mismatch is the most common silent failure. |
| ARN | Amazon Resource Name - AWS's full path-like name for any object, for example, arn:aws:iam::123456789012:role/atlan-athena-role. Always copy-paste ARNs; never retype. |
| STS (AWS) | AWS Security Token Service - issues the temporary (default one-hour) credentials when a role is assumed. |
| Glue Data Catalog | The AWS metadata store that Glue and Athena share: database, table, and column definitions live here, not in Athena itself. Atlan reads both. |
| Lake Formation | An optional AWS permission layer on top of Glue. If your organization uses it, IAM permissions alone aren't enough - the Atlan role also needs Lake Formation grants. |
| KMS | AWS Key Management Service. If your Glue catalog or S3 buckets are encrypted with a KMS key, the Atlan role also needs kms:Decrypt on that key. |
| Host / Server URL (Tableau) | The address of your Tableau, without https:// and without any path. Cloud example: prod-useast-a.online.tableau.com. Server example: tableau.example-corp.com. Never paste a full browser URL here. |
| Site (Tableau) | A partition inside one Tableau deployment. Its name is the part after /site/ in your browser URL, and it is case-sensitive. Tableau Server's default site has an empty site name - leave the field blank. |
| PAT (personal access token) | A named long-lived credential (name + secret value) issued per Tableau user. One PAT = one active session; unused PATs expire after 15 days. |
| Connected App / JWT (Tableau) | Tableau's app-to-app trust mechanism. Atlan supports Direct Trust connected apps with scopes tableau:content:read, tableau:users:read, and optionally tableau:workbooks:download. |
| Site Administrator Explorer | The Tableau site role Atlan's user needs to see all fields and calculated fields. Lower roles connect fine but silently return less metadata. |
| REST API version (Tableau) | Every Tableau release speaks a numbered API dialect. Atlan's preflight requires ≥ 2.4; the connector overall targets Tableau 2022.x+ (REST API 3.14+). |
| Metadata API / GraphQL (Tableau) | Tableau's lineage database and its query language. It has its own limits - node caps, internal timeouts, post-upgrade re-indexing called backfill. |
| SSL / TLS certificate | The ID card a server shows to prove it is who it claims. Atlan verifies it on every connection. |
| Certificate chain | Certificates come in a chain: your server's cert (leaf) → the authority that issued it (intermediate) → a globally trusted root. If your server only shows the leaf, verification fails with "unable to get local issuer certificate". |
| Self-signed certificate | A cert issued by your own company rather than a public authority. Valid - but you must provide the chain in Atlan's SSL certificate field so Atlan knows to trust it. |
| IP allowlist | A "who may knock" list. Tableau Cloud has a built-in one (Settings → Authentication); self-hosted servers use your company firewall instead. |
| WAF (web application firewall) | A filter in front of a server that inspects request content, not just source IP. A WAF can block Atlan's lineage queries even when the IP is allowlisted. |
| Endpoint service / NLB | AWS PrivateLink building blocks: a network load balancer (NLB) in front of your server, exposed as a private "endpoint service" that Atlan plugs into. |
| Permission policy (identity policy) | What an AWS identity may do - the list of allowed actions like s3:ListBucket. Attached to your role or user. |
| Bucket policy (resource policy) | A rulebook attached to an S3 bucket instead of the identity. An explicit Deny here overrides every Allow everywhere. |
| Explicit Deny | A policy statement with "Effect": "Deny". In AWS, one Deny beats all Allows - the #1 cause of "but I granted everything!" confusion. |
atlan-test-credential-helper | The session name Atlan's Test connection uses when borrowing your AWS role. Normal in errors and CloudTrail; not an intruder. |
| SSE-KMS | S3 server-side encryption using a customer-managed KMS key. The key has its own policy - reading encrypted objects needs kms:Decrypt on it, in addition to the bucket permissions. |
| PermanentRedirect | AWS's error when an S3 bucket is addressed in the wrong region. In Atlan it means the region field is wrong - or, in some offline flows, invisibly empty (defaults to us-east-1). |
| Instance profile ARN vs role ARN | Two ARNs that name the same role: arn:aws:iam::…:instance-profile/<name> (the EC2 wrapper) and arn:aws:iam::…:role/<name>. Trust policies require the role form - an instance-profile ARN as Principal is rejected or silently fails. If support shares an instance-profile/ ARN, swap that word for role/. |
| Service account (Google Cloud) | A robot user in Google Cloud. You create it, grant it read-only permissions, and Atlan signs in as it. Nothing Atlan does can exceed what you granted. |
| Workload Identity Federation (WIF) | Keyless sign-in: Google is configured to trust identity tokens issued by your Atlan tenant, so no key file ever exists. Uses a pool (a trust container) and a provider (the trust rule pointing at Atlan). |
| OIDC token | A short-lived, signed "who I am" statement - the thing Atlan presents to Google under WIF. Expires in minutes; nothing to store or rotate. |
| STS (Security Token Service) | Google's token-exchange desk (sts.googleapis.com): swaps Atlan's OIDC token for a temporary Google credential. Only used with WIF. |
| Impersonation | The second WIF step: the temporary credential is used to act as your service account (via iamcredentials.googleapis.com). Requires the roles/iam.workloadIdentityUser grant. |
| WIF Pool Provider ID | The full path of your trust rule, always starting //iam.googleapis.com/projects/…/providers/…. A frequent copy-paste trap - if your value contains /subject/, it's the wrong string. |
| Private Service Connect (PSC) | Google's private on-ramp: an endpoint inside Atlan's network that leads straight onto Google's internal backbone, keeping API traffic off the public internet. Atlan builds it; you get a DNS name to paste into the crawler. |
| PSC endpoint DNS name | The private hostname Atlan support gives you, in the format https://bigquery-<privateserver>.p.googleapis.com, used with port 443 in the crawler's "Private Network Link" option. |
| VPC Service Controls (VPC-SC) | An optional Google security fence ("perimeter") around your projects that blocks API access from outside - even with valid credentials - unless an ingress rule allows it. Independent of PSC. |
| Ingress / egress rule | Exceptions in a VPC-SC perimeter: ingress = who may call in (Atlan needs this), egress = what inside may call out (needed for the Lakehouse integration). |
| Cloud Resource Manager API | The Google API Atlan's preflight uses to verify permissions (testIamPermissions). Must be enabled in the project or preflight fails with a generic "unable to connect" error. |
| Workgroup (Athena) | Athena's way of grouping queries for settings and cost controls. Atlan uses the primary workgroup unless you specify another in the connection form. |
| S3 output location (results bucket) | The S3 bucket path where Athena writes every query result before anyone can read it. Atlan needs read/write access to it. |
| VPC interface endpoint / PrivateLink | A private "door" to an AWS service inside a network, so traffic to athena.<region>.amazonaws.com (for example) never crosses the public internet. Identified by an ID like vpce-0123456789abcdef0. |
| Service account JSON key | A downloadable file that proves "I am this robot". It never expires on its own but can be rotated or deleted in Google Cloud - which silently breaks any Atlan schedule using it. |
| VPC | "Virtual Private Cloud" - a private, fenced-off network inside AWS. Your data source lives in your VPC; your Atlan tenant lives in Atlan's. |
| Private IP | An address (usually starting 10., 172.16–31., or 192.168.) that only works inside your VPC. Atlan's cloud cannot reach it directly - entering one as the Host in Direct mode always fails. |
| Public IP | An optional internet-reachable address for a database instance. Off by default in AlloyDB; your Google Cloud admin must enable it deliberately. |
| Authorized networks | Google's guard list for a database's public IP: only connections from listed IP addresses/ranges are admitted. This is where Atlan's egress IPs go. |
| Service attachment | The "socket" - the thing your cloud team publishes to make a Google Cloud database instance connectable over PSC. Identified by a Service Attachment URL like projects/…/regions/…/serviceAttachments/…. |
| Consumer (PSC) endpoint | The "plug" - a private address inside Atlan's network that forwards traffic into your service attachment. Atlan support creates and owns it. |
| Instance URI | AlloyDB's full path-like name for an instance: projects/<project>/locations/<region>/clusters/<cluster>/instances/<instance>. Needed for IAM-based auth methods - and not the same thing as a service attachment URL. |
| IAM database authentication | Logging in to the database with a Google Cloud identity (a user or service account) instead of a database password. Must be enabled on the instance first, and the identity must also be added as a database user - the IAM role alone is not enough. |
| Instance connection name | A Cloud SQL instance's globally unique name, shaped like my-project:us-central1:my-instance - copy it from the instance's Overview page. Required for IAM authentication methods. |
| Secret store / Key Type | Where the self-deployed runtime reads database credentials from (GCP Secret Manager, HashiCorp Vault, etc.). The "Key Type" field describes how the secret is laid out - for GCP Secret Manager choose Single Key (each credential is its own secret entry). |
| SSL mode / "Allow only SSL connections" | Whether connections must be encrypted with SSL/TLS. If the server requires SSL and the Atlan connection has SSL off, the server rejects the attempt before checking your password - the error ends in SSL off. |
pg_hba.conf / connection rules | PostgreSQL's own rulebook for who may connect, from where, and whether SSL is required. On managed services like Cloud SQL and RDS/Aurora, the provider manages it from your instance settings - you'll only ever see it named inside error messages. |
| Self-deployed runtime (SDR) | A small Atlan-provided service you run on Docker Compose or Kubernetes inside your network. Outbound HTTPS to Atlan only; reads sources locally. Also called the "secure agent" in older material. |
hostssl rule | A pg_hba.conf rule type that only matches encrypted connections. If the only matching rule is hostssl, unencrypted connections are rejected with SSL off in the error. |
sslmode | The client-side PostgreSQL setting that decides whether the connection is encrypted: disable, prefer (avoid - triggers the classic SSL off rejection against SSL-required servers), require (the sensible default), verify-ca/verify-full. |
| RDS proxy | An optional AWS component that gives RDS a stable address, so an NLB target doesn't break when the database's underlying IP changes (which happens on failover and some maintenance). |
| VPCE DNS name | The DNS name of the VPC endpoint (the "plug") Atlan builds for AWS PrivateLink, in the form vpce-<hash>-<hash>.vpce-svc-<hash>.<region>.vpce.amazonaws.com. For PrivateLink database connections, this is the value that goes in Atlan's Host field - not your database's own hostname. |
pg_stat_statements | A PostgreSQL extension that records query history. The Atlan miner (lineage/usage) requires it; the crawler does not. Installing it needs a superuser once - the Atlan user itself does not need superuser. |
| PLS alias / endpoint service name | The globally unique name of your private link "socket" (e.g. myservice.abc123.westeurope.azure.privatelinkservice or com.amazonaws.vpce.us-east-1.vpce-svc-...). You share it with Atlan on the setup ticket. It is not a hostname - never paste it into a crawler's Host field. |
| Endpoint DNS name | The hostname Atlan sends you after its private endpoint is built and approved (e.g. vpce-....vpce-svc-....us-east-1.vpce.amazonaws.com). This is what goes in the crawler's Host field for private link connections. |
| Resource ID (Azure) | Azure's full path-like identifier for any object (starts /subscriptions/...). For Azure SQL private links, Atlan needs your server's or Managed Instance's Resource ID to build the endpoint. Find it under Overview → JSON view. |
| Listener / redirect (SQL Server) | SQL Server (especially Always On availability groups and named instances) may answer "connect to this other host/port instead". Firewalls must allow the redirect target too, or connections mysteriously time out mid-handshake. Use a fixed port - dynamic ports break load balancers and firewalls. |
| Windows Domain / NTLM | Active Directory login for SQL Server. Requires the Windows Domain name (e.g. CORP) in its own field in the crawler setup - its absence is a recurring cause of "Login failed" with otherwise perfect credentials. |
| Encrypt / TrustServerCertificate | TLS settings of a SQL Server connection. The connector negotiates encryption with certificate validation relaxed, so self-signed certificates generally don't block connections - a "handshake" error is almost always a firewall, not a certificate. |
| Private DNS zone | A name book that only works inside a network. Hostnames like db.corp.example-corp.local live here - Atlan cannot resolve them from outside; use a private link or the self-deployed runtime. |