Create a Private Network Route for Amazon Redshift

To enable federation connections, connect your Redshift data source and your Data 360 tenant with a dedicated network route using Private Connect for Data 360. Private Connect supports self-managed PrivateLink. Redshift-managed PrivateLink isn’t currently supported.

Prerequisites

Available in: All Editions supported by Data 360. See Data 360 edition availability.

Note

User Permissions Needed
To create a Redshift network route	Data 360 Architect permission set OR Manage External Connections or Customize Application permissions
To administer an Amazon Web Services (AWS) environment	AWS account administrator

Configure a PrivateLink endpoint service for your Redshift cluster.
Verify the Security Group rules can accept traffic from the Network Load Balancer (NLB) created for this endpoint service.
Verify that the target group is connected to the NLB so that the NLB knows where to route requests.
Make sure that the security group associated with the NLB allows inbound traffic on port 5439 port.
If your Redshift and Data 360 instances are in different regions, verify that the region of your Data 360 instance is selected under Supported Regions.
The Data 360 virtual private cloud (VPC) endpoint ID and Data 360 DNS Name are available on the details page of the network route after it’s provisioned. In some case you may need to modify your network policy to include the Data 360 VPC endpoint ID. An alternative method is to add the internal IP address range 10.0.0.0/8 to your network policy’s allowed list. This reserved address range is specifically designated for private networks and allows traffic to originate from a wide range of private Data 360 IP addresses.

Private Connect isn’t required to share data from Data 360 to Redshift.

Note

See the AWS Big Data Blog series for more information:

Part 1: For Data Federation, see Harness Zero Copy data sharing from Salesforce Data 360 to Amazon Redshift for Unified Analytics
Part 2: For Data Share, see Zero Copy data sharing from Salesforce Data 360
Part 3: For Private Connect for Data 360, see Enhance Agentforce data security with Private Connect for Salesforce Data 360 and Amazon Redshift

Steps

From the App Launcher, select Data 360.
From Setup, select Data Cloud Setup.
From Data Cloud Setup, expand Admin Tools and select Private Connect.
Click New.
Select Redshift, and click Setup.
For Step 1, add the Principal ID to your AWS VPC endpoint service:
1. Copy the generated Principle ID.
2. Go to your AWS account.
3. Under Virtual private cloud, select Endpoint services.
4. Select the check box next to the Service ID of the VPC endpoint service.
5. On the Allow principals tab, click Allow principals.
6. In the Principals section, paste the principal Amazon Resource Name (ARN) that you copied earlier.
7. Click Allow principals.
In your AWS account, select the VPC endpoint service that you want to use to access your Redshift cluster.
1. Under Virtual private cloud, select Endpoint services.
2. Select the relevant endpoint service.
3. Go to the Details tab and copy the Service name.
  
  The Service name is in the format of: com.amazonaws.vpce.<region>.<account_ID>
For Step 2, in the Configure Amazon Redshift Private Network Route page:
1. Enter a name and an API name for the network route and the network API name.
  
  You can’t change the route name after you save it.
2. (Optional) Enter a description for the network route.
3. Paste the name of your VPC endpoint service in the format: com.amazonaws.vpce.<region>.<account_ID>
4. Click Save.
In the AWS VPC dashboard, accept the network connectivity request.

After You Finish

The Data 360 VPC endpoint ID and Data 360 DNS Name are available on the details page of the network route after it’s provisioned. In some case you may need to modify your network policy to include the Data 360 VPC endpoint ID.

When the network provisioning completes successfully, you can create a federated connection for Redshift. There can be a brief delay before you can create a federated connection or data share due to DNS configuration.