Network and database configuration requirements - Amazon QuickSight
Network configuration requirements

Network and database configuration requirements

To serve as data sources, databases need to be configured so that Amazon QuickSight can access them. Use the following sections to make sure that your database is configured appropriately.

Important

Because a database instance on Amazon EC2 is administered by you rather than AWS, it must meet both the Network configuration requirements as well as the Database configuration requirements for self-administered instances.

Network configuration requirements

   Intended audience: System administrators 

For you to use your database server from QuickSight, your server must be accessible from the internet. It must also allow inbound traffic from QuickSight servers.

If the database is on AWS and in the same AWS Region as your QuickSight account, you can auto-discover the instance to make connecting to it easier. To do this, you must grant QuickSight permissions to access it. For more information, see Accessing data sources.

Network configuration for an AWS instance in a default VPC

In some cases, your database might be on an AWS cluster or instance that you created in a default VPC. Thus, it's publicly accessible (that is, you didn't choose to make it private). In such cases, your database is already appropriately configured to be accessible from the internet. However, you still need to enable access from QuickSight servers to your AWS cluster or instance. For further details on how to do this, choose the appropriate topic following:

Network configuration for an AWS instance in a nondefault VPC

If you are configuring an AWS instance in a nondefault VPC, make sure that the instance is publicly accessible and that the VPC has the following:

  • An internet gateway.

  • A public subnet.

  • A route in the route table between the internet gateway and the AWS instance.

  • Network access control lists (ACLs) in your VPC that allow traffic between the cluster or instance and QuickSight servers. These ACLs must do the following:

    • Allow inbound traffic from the appropriate QuickSight IP address range and all ports to the IP address and port that the database is listening on.

    • Allow outbound traffic from the database’s IP address and port to the appropriate QuickSight IP address range and all ports.

    For more information about QuickSight IP address ranges, see IP address ranges for QuickSight following.

    For more information about configuring VPC ACLs, see Network ACLs.

  • Security group rules that allow traffic between the cluster or instance and QuickSight servers. For further details on how to create appropriate security group rules, see Authorizing connections to AWS data stores.

For more information about configuring a VPC in the Amazon VPC service, see Networking in Your VPC.

Network configuration for an AWS instance in a private VPC

If your database is on an AWS cluster or instance that you created in a private VPC, you can use it with QuickSight. For more information, see Connecting to a VPC with Amazon QuickSight.

For more information on Amazon VPC, see Amazon VPC and Amazon VPC Documentation.

Network configuration for an AWS instance that is not in a VPC

If you are configuring an AWS instance that is not in a VPC, make sure that the instance is publicly accessible. Also, make sure that there is a security group rule that allows traffic between the cluster or instance and QuickSight servers. For further details on how to do this, choose the appropriate topic following:

Network configuration for a database instance other than AWS

To use SSL to secure your connections to your database (recommended), make sure that you have a certificate signed by a recognized certificate authority (CA). QuickSight doesn't accept certificates that are self-signed or issued from a nonpublic CA. For more information, see QuickSight SSL and CA certificates.

If your database is on a server other than AWS, you must change that server's firewall configuration to accept traffic from the appropriate QuickSight IP address range. For more information about QuickSight IP address ranges, see IP address ranges for QuickSight. For any other steps that you need to take to enable internet connectivity, see your operating system documentation.

QuickSight SSL and CA certificates

Following is a list of accepted public certificate authorities. If you are using a database instance other than AWS, your certificate must be on this list, or it won't work.

  • AAA Certificate Services

  • AddTrust Class 1 CA Root

  • AddTrust External CA Root

  • AddTrust Qualified CA Root

  • AffirmTrust Commercial

  • AffirmTrust Networking

  • AffirmTrust Premium

  • AffirmTrust Premium ECC

  • America Online Root Certification Authority 1

  • America Online Root Certification Authority 2

  • Baltimore CyberTrust Code Signing Root

  • Baltimore CyberTrust Root

  • Buypass Class 2 Root CA

  • Buypass Class 3 Root CA

  • Certum CA

  • Certum Trusted Network CA

  • Chambers of Commerce Root

  • Chambers of Commerce Root - 2008

  • Class 2 Primary CA

  • Class 3P Primary CA

  • Deutsche Telekom Root CA 2

  • DigiCert Assured ID Root CA

  • DigiCert Global Root CA

  • DigiCert High Assurance EV Root CA

  • Entrust.net Certification Authority (2048)

  • Entrust Root Certification Authority

  • Entrust Root Certification Authority - G2

  • Equifax Secure eBusiness CA-1

  • Equifax Secure Global eBusiness CA-1

  • GeoTrust Global CA

  • GeoTrust Primary Certification Authority

  • GeoTrust Primary Certification Authority - G2

  • GeoTrust Primary Certification Authority - G3

  • GeoTrust Universal CA

  • Global Chambersign Root - 2008

  • GlobalSign

  • GlobalSign Root CA

  • Go Daddy Root Certificate Authority - G2

  • GTE CyberTrust Global Root

  • KEYNECTIS ROOT CA

  • QuoVadis Root CA 2

  • QuoVadis Root CA 3

  • QuoVadis Root Certification Authority

  • SecureTrust CA

  • Sonera Class1 CA

  • Sonera Class2 CA

  • Starfield Root Certificate Authority - G2

  • Starfield Services Root Certificate Authority - G2

  • SwissSign Gold CA - G2

  • SwissSign Platinum CA - G2

  • SwissSign Silver CA - G2

  • TC TrustCenter Class 2 CA II

  • TC TrustCenter Class 4 CA II

  • TC TrustCenter Universal CA I

  • Thawte Personal Freemail CA

  • Thawte Premium Server CA

  • thawte Primary Root CA

  • thawte Primary Root CA - G2

  • thawte Primary Root CA - G3

  • Thawte Server CA

  • Thawte Timestamping CA

  • T-TeleSec GlobalRoot Class 2

  • T-TeleSec GlobalRoot Class 3

  • UTN - DATACorp SGC

  • UTN-USERFirst-Client Authentication and Email

  • UTN-USERFirst-Hardware

  • UTN-USERFirst-Object

  • Valicert

  • VeriSign Class 1 Public Primary Certification Authority - G3

  • VeriSign Class 2 Public Primary Certification Authority - G3

  • VeriSign Class 3 Public Primary Certification Authority - G3

  • VeriSign Class 3 Public Primary Certification Authority - G4

  • VeriSign Class 3 Public Primary Certification Authority - G5

  • VeriSign Universal Root Certification Authority

  • XRamp Global Certification Authority

IP address ranges for QuickSight

For more information on the IP address ranges for QuickSight in supported Regions, see AWS Regions, websites, IP address ranges, and endpoints.