External BI tool connection with Redshift-Managed Endpoint

Hello.

I'm not familiar with Qlik Cloud BI tool, but Redshift can be accessed from outside by setting it to public access.
So, as you may know, security can be improved by controlling communication using security groups and NACLs.
https://repost.aws/knowledge-center/redshift-cluster-private-public

To connect your Qlik cloud BI tool (SaaS) to your private Redshift cluster, using a Redshift-managed VPC endpoint is a good approach, but there are some important considerations.

Redshift-managed VPC endpoints are designed to provide private connections between VPCs without exposing traffic to the public internet. However, they aren't designed to be placed in public subnets for access from the internet. Redshift-managed VPC endpoints are not accessible from the internet by design - they're meant for private connectivity between AWS resources.

For your scenario with Qlik cloud (hosted in a multi-tenant AWS account), you have several options:

1. If Qlik cloud is hosted in AWS, you could potentially set up a Redshift-managed VPC endpoint as a private connection between your VPC containing the Redshift cluster and the VPC where Qlik is running. This would require the Redshift cluster owner (your account) to grant access to the account where Qlik is running.

2. You could use AWS PrivateLink to establish a secure connection between your Redshift cluster and the Qlik cloud environment.

3. You could set up a VPN connection or AWS Direct Connect between your VPC and the network where Qlik is running.

4. You could create a serverless API using AWS Lambda and API Gateway that Qlik can call to retrieve Redshift data.

For any of these approaches, you would still need to configure appropriate security groups to allow traffic from the specific sources. If Qlik cloud is truly running as a SaaS solution with public IP addresses, you might need to consider other options like setting up a secure API gateway or using AWS Direct Connect with your SaaS provider.

Remember that when implementing any solution, you should follow security best practices such as using IAM roles with least privilege, ensuring SSL/TLS encryption for connections, and implementing proper network security controls.
Sources
Accessing Redshift data in PowerBI | AWS re:Post
Redshift-managed VPC endpoints - Amazon Redshift
Creating a Redshift-managed VPC endpoint - Amazon Redshift