How do I connect Quick Suite to a private Amazon RDS data source in a different AWS Region or AWS account?

Short description

Example Amazon RDS data source and Amazon Virtual Private Cloud (Amazon VPC) configuration:

Account type	Amazon RDS data source in the same Region	Amazon RDS data source in a different Region
Same AWS account	Amazon VPC connection in Quick Suite	Amazon VPC peering
Different AWS account	Amazon VPC peering	Amazon VPC peering

Resolution

The following resolution applies to Quick Suite Enterprise edition.

Note: It's a best practice to upgrade to Quick Suite Enterprise edition to securely access Amazon RDS data sources. For more information about Quick Suite Enterprise edition pricing, see Amazon Quick Suite pricing.

With Quick Suite Enterprise edition, you can connect to an Amazon VPC through an elastic network interface. This connection keeps the network traffic private within the AWS network. You can also connect Amazon RDS data sources from Quick Suite in the same Region or account with an Amazon VPC connection. For instructions, see How do I create a private connection from Quick Sight to an Amazon Redshift cluster or an Amazon RDS DB instance that's in a private subnet?

Prepare your Quick Suite environment

This resolution uses the following Amazon RDS configuration:

• RDS data source is hosted on VPC: vpc-33cc44dd
• CIDR range of vpc-33cc44dd: 172.0.0.0/16
• Subnet IDs and associated route table IDs: subnet-3c3d (rtb-33cd), subnet-4c4d (rtb-44cd)
• Security group associated with RDS data source: sg-445566

Note: If you already have an Amazon VPC and subnet, go to step 3.

Complete the following steps:

1. Create an Amazon VPC and a subnet in the same Region as your Quick Suite account.
   Note: Make sure that the CIDR block of your Amazon VPC is different than the CIDR block of your Amazon RDS instance. If you want to use the hostname of the Amazon RDS data source, then activate DNS hostnames and DNS resolution. For more information, see Setting up DNS in your VPC.
   Example Amazon VPC configuration:

   Name                       VPC           IPv4 CIDR      Description-----------------------------------------------------------------------------------------  
   Quick Suite Account VPC    vpc-11aa22bb  10.0.0.0/16    VPC created in the Quick Suite account

   Example subnets configuration:

   Name                                  Subnet ID      VPC            IPv4 CIDR     Route table----------------------------------------------------------------------------------------------
   Subnet 1 - Quick Suite Account VPC    subnet-1a1b    vpc-11aa22bb   10.0.0.0/20   rtb-11ab
   Subnet 2 - Quick Suite Account VPC    subnet-2a2b    vpc-11aa22bb   10.0.16.0/20  rtb-22ab

2. Create a security group and add an inbound rule for all TCP traffic from the Amazon VPC CIDR range of the Amazon RDS data source:
   Choose the Amazon VPC that you created in step 1.
   In Inbound rules, for Type, choose All TCP.
   For Source, choose Custom.
   If you use Tags, then, for Value, enter the VPC CIDR range of the Amazon RDS data source.
   Example Quick Suite security group configuration:

   Security Group ID    Security Group Name           VPC ID---------------------------------------------------------------
   sg-112233            Quick Suite Security Group    vpc-11aa22bb

   Example inbound rule configuration:

   Type       Protocol   Port Range   Source          Description------------------------------------------------------------------------------
   All TCP    TCP        0-65535      172.0.0.0/16    VPC CIDR of RDS Data Source

3. Create the VPC connection in the Quick Suite console.
   Configure the VPC connection and Subnet ID that you created in step 1, and the Security group ID that you created in step 2.
   Note: Log in as a Quick Suite administrator. Only Quick Suite administrators can view the Manage Quick Suite option.
   Example Amazon VPC connection configuration in Quick Suite:

   VPC connection name        VPC connection ARN                                                               Subnet ID      Security group ID    DNS resolvers-----------------------------------------------------------------------------------------------------------------------------------------------------------------
   VPCConnectionQuickSuite    arn:aws:quicksight:us-east-1:121212121212:vpcConnection/VPCConnectionQuickSuite    subnet-1a1b    sg-112233

Prepare the Amazon RDS environment

Add an inbound rule in the security group associated with the Amazon RDS data source. This rule allows all TCP traffic from the Amazon VPC CIDR range of the Quick Suite account Amazon VPC.

Example security group inbound rule (sg-445566) configuration of the Amazon RDS data source:

Type       Protocol   Port Range   Source         Description------------------------------------------------------------------------------------
All TCP    TCP        0-65535      10.0.0.0/16    VPC CIDR of Quick Suite Account VPC

Amazon VPC Peering

Create a connection between the Amazon VPCs

To create a VPC peering connection between the Amazon VPC with the Quick Suite account and the Amazon VPC with the Amazon RDS data source, complete the following steps:

1. Open the Amazon VPC console.
2. In the navigation pane, choose Peering connections, and then choose Create peering connection.
3. (Optional) For Name, enter a name for the peering connection. For example, Quick Suite RDS VPC peering.
4. For VPC ID, choose your VPC.
5. For Select another VPC to peer with, take one of the following actions:
   If your RDS data source and Quick Suite use the same AWS account, then choose My account.
   -or-
   If your RDS data source and Quick Suite use different AWS accounts, then choose Another account.
6. For Region, take one of the following actions:
   Choose This Region if your Amazon RDS data source and Quick Suite use the same AWS account. Then, for VPC ID, choose your Amazon VPC.
   -or-
   Choose Another Region, and then for Region, choose the Region for the RDS data source and VPC. For VPC ID, enter the VPC ID.
7. Choose Create peering connection.

Example of Amazon VPC peering connection configuration:

Name                           Peering connection ID    Status               Requester VPC    Accepter VPC--------------------------------------------------------------------------------------------------------  
Quick Suite RDS VPC peering    pcx-ab12cd34             Pending acceptance   vpc-11aa22bb     vpc-33cc44dd

Accept an Amazon VPC peering connection

An Amazon VPC peering connection in the pending-acceptance state must be accepted in the same account and Region of the accepter Amazon VPC. For instructions, see Accept or reject a VPC peering connection.

Example Amazon VPC peering connection configuration:

Name                           Peering connection ID    Status   Requester VPC    Accepter VPC--------------------------------------------------------------------------------------------------------  
Quick Suite RDS VPC peering    pcx-ab12cd34             Active   vpc-11aa22bb     vpc-33cc44dd

Note: To use the hostname of the Amazon RDS data source, you must activate the DNS resolution for an Amazon VPC peering connection. You must also activate the DNS resolution for both Amazon VPCs.

Update the route tables

Update the route tables in the Quick Suite account and RDS data source account to route network traffic. The route destination is the CIDR block of the peer VPC and the target is the ID of the VPC peering connection.

Note: To avoid connectivity loss, make sure to update the route tables with the same routes for all subnets associated with the Amazon RDS data source.

Example Quick Suite Amazon VPC connection subnets route table (rtb-11ab) configuration:

Destination     Target----------------------------  
10.0.0.0/16     local
172.0.0.0/16    pcx-ab12cd34

Example Amazon RDS data source subnets route tables (rtb-33cd, rtb-44cd) configuration:

Destination     Target-----------------------------  
172.0.0.0/16    local
10.0.0.0/16     pcx-ab12cd34

Connect Quick Suite to the Amazon RDS data source

Complete the following steps:

1. Open the Quick Suite console.
2. In the navigation pane, choose Datasets, and then choose New dataset.
3. Choose your database engine.
4. For Connection type, choose the Amazon VPC that you created for step 3 in the Prepare your Quick Suite environment section of this article.
5. Enter the variables for your database.
6. Choose Validate connection to make sure that Quick Suite can connect to the data source, and then choose Create data source.
7. Choose the database that you want to use, choose a table, and then choose Select.

For more information, see Creating a dataset using an existing database data source.

Related information

Amazon QuickSight deployment models for cross-account and cross-Region access to Amazon Redshift and Amazon RDS