Securing Quick access from corporate networks with AWS PrivateLink

Securing Quick Access from Corporate Networks with AWS PrivateLink

Enterprises often need to let Amazon Quick query on‑premises data while keeping that traffic off the public internet. By combining AWS PrivateLink VPC endpoints for user and API access with VPC connections for data‑source traffic, you can create a fully private, compliant, and low‑latency path that runs over your existing Direct Connect or Site‑to‑Site VPN.

---

1. Understand the Two Traffic Paths

| Traffic Type | What It Does | Private Mechanism | |--------------|--------------|-------------------| | User‑facing – console, API calls, embedded Quick UI | Users interact with Quick from browsers or applications. | VPC endpoints (PrivateLink) keep these requests inside the AWS backbone. | Data‑fetching – Quick pulling data from databases, Redshift, internal APIs, or custom MCP servers | Quick needs to read/write enterprise data to power dashboards, flows, and agents. | VPC connections extend the VPC into your on‑prem network, using the same Direct Connect/VPN link.

Both paths must be secured, but they require different configurations.

---

2. Prerequisites

1. AWS account with an Amazon Quick Enterprise subscription (required for VPC connections).
2. VPC in the same AWS Region where Quick is deployed (China and GovCloud regions are excluded).
3. Direct Connect or Site‑to‑Site VPN already linking your data center to the VPC.
4. IAM permissions to create/manage VPC endpoints, security groups, and Quick VPC connections (e.g., `quicksight:CreateVPCConnection`, `ec2:DescribeSubnets`, `iam:PassRole`).
5. DNS resolution for private endpoints (Route 53 private hosted zones or on‑prem DNS forwarders).

---

3. Configure Private User Access with AWS PrivateLink

1. Create Interface VPC Endpoints for the Quick service endpoints (`com.amazonaws.<region>.quicksight` and any additional Quick APIs).
2. Attach Security Groups that allow inbound traffic only from your corporate CIDR blocks and the Direct Connect gateway.
3. Define Endpoint Policies that restrict actions to the required Quick operations (e.g., `quicksight:Describe`, `quicksight:List`).
4. Update DNS – enable private DNS for the endpoint so that `quicksight.aws.amazon.com` resolves to the endpoint IPs inside the VPC.

Result: Users on the corporate network reach the Quick console and APIs without ever hitting the public internet, reducing exposure and simplifying audit logs.

---

4. Set Up VPC Connections for Data Sources

1. Open the Quick console → Manage → VPC connections → Create VPC connection.
2. Select the VPC and Subnet where the connection will be placed. Choose a subnet that has a route to your on‑prem network via Direct Connect or VPN.
3. Assign an IAM role (the Quick execution role) that grants Quick permission to assume the role and access the target resources.
4. Configure Security Groups to allow traffic from Quick’s ENIs to the on‑prem database ports (e.g., 5432 for PostgreSQL, 1433 for SQL Server).
5. Add the Data Source in Quick (e.g., a PostgreSQL database) and reference the newly created VPC connection.
6. Test the connection using Quick’s built‑in Test connection button; successful validation confirms private routing.

All data‑fetching traffic now travels over the same Direct Connect/VPN link, staying within the AWS backbone and your corporate network.

---

5. Harden the Architecture (Defense‑in‑Depth)

• Security Groups: Use least‑privilege rules; restrict inbound to specific ports and source CIDRs.
• Network ACLs: Optionally add a layer of subnet‑level filtering for extra protection.
• Endpoint Policies: Limit API actions to only those required by your users.
• Logging & Monitoring: Enable VPC Flow Logs on the endpoint subnets and CloudTrail for Quick API calls to maintain a clear audit trail.
• Encryption: Ensure TLS is enforced for all Quick‑to‑data‑source connections; use AWS KMS for any data‑at‑rest encryption.

---

6. Verify Compliance and Performance

| Goal | How to Verify | |------|---------------| | No public exposure | Check that DNS resolves to private IPs and that VPC Flow Logs show no outbound traffic to the internet for Quick traffic. | | Regulatory compliance (HIPAA, FedRAMP, PCI‑DSS) | Review endpoint policies, security‑group rules, and audit logs against the relevant control matrix. | | Low latency | Use Quick’s built‑in performance metrics or CloudWatch latency dashboards to compare against baseline public‑internet access. |

---

7. Practical Takeaway

By layering AWS PrivateLink VPC endpoints for user interaction with VPC connections for data retrieval, you achieve a fully private, auditable, and compliant network path for Amazon Quick. This architecture eliminates the public‑internet attack surface, satisfies strict regulatory mandates, and delivers consistent performance for AI‑driven insights across your enterprise.