> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://help.sigmacomputing.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://help.sigmacomputing.com/_mcp/server. # AWS PrivateLink Connections If your Sigma organization runs on Amazon Web Services (AWS), you can securely connect to your data using AWS PrivateLink. AWS PrivateLink is a security feature that allows users to create connections between your AWS Virtual Private Cloud (VPC) without sending traffic over the public internet. Sigma can connect to cloud data platforms via AWS PrivateLink in all Amazon regions with PrivateLink support. For more information on the security advantages and internals of PrivateLink, see the AWS documentation on AWS PrivateLink. This document explains how to set up AWS PrivateLink connections from Sigma to your data platform. This is a premium feature. To enable it for your Sigma organization, contact your Sigma Account Executive. ## System and user requirements The following are required for all AWS PrivateLink connections: * A Sigma organization running on AWS. Your Sigma organization must be on the same cloud as your data platform to use private link. If your organization is hosted in Azure, see [Azure Private Link connections](/docs/azure-private-link-connections). * You must be assigned the Admin account type in Sigma. See [User account types](/docs/account-type-and-license-overview). * An AWS VPC-deployed Snowflake (self-managed or VPS), Redshift, MySQL, SQL Server 2022, Starburst, Postgres data warehouse, or custom proxy server in any AWS region. This feature does not support BigQuery warehouses or self-managed warehouses running on Azure, GCP, or VMWare clouds. Additional requirements might also apply depending on the data platform and specific PrivateLink configuration method. Refer to the section for your data platform and configuration. ## Connecting to your data with PrivateLink The steps below cover both updating existing public connections to use PrivateLink, and creating a new connection to use PrivateLink. The process to set up PrivateLink depends on the data platform your organization uses: * [Snowflake](#snowflake) * [Redshift](#redshift) * [Databricks](#databricks) * [MySQL, SQL Server 2022, PostgreSQL, Starburst, and custom proxy servers (e.g. secuPi)](#mysql-sql-server-2022-postgresql-starburst-or-custom-proxy-servers) ## Snowflake Connecting to Snowflake via PrivateLink depends on your Snowflake configurations: * If you are a Snowflake customer with the Business Critical (or higher) edition and do not use a Virtual Private Server (VPS) or proxy server, you might be able to connect via Snowflake’s PrivateLink integration. For instructions, see [Connect with Snowflake’s PrivateLink integration](#connect-with-snowflakes-privatelink-integration). * If you are a Snowflake customer and use a Virtual Private Server (VPS) or proxy server, see [Connect to Snowflake via your own VPC](#connect-to-snowflake-via-your-own-vpc). * If you want to create a PrivateLink connection to a Snowflake internal stage, see [Connect to a Snowflake internal stage](#connect-to-a-snowflake-internal-stage). ### Connect with Snowflake’s PrivateLink integration Snowflake’s PrivateLink integration allows Sigma to create a secure connection over PrivateLink directly to the Snowflake VPC that contains your data. Traffic between Sigma and your Snowflake account will travel exclusively on the AWS backbone. You do not need an Amazon account or VPC of your own - only the account managed by Snowflake must reside in an AWS VPC. #### Additional requirements * Snowflake requires Business Critical (or higher) edition for PrivateLink support. * Confirm your Sigma organization’s eligibility with your Sigma Account Executive. * If your Snowflake account uses VPS or you connect Sigma to Snowflake with a proxy server, you cannot use Snowflake’s PrivateLink integration. See [Connect to Snowflake via your own VPC](#connect-to-snowflake-via-your-own-vpc). * You must be a Snowflake account administrator (your system role should be `ACCOUNTADMIN`). * Contact Snowflake support and request that Sigma’s AWS account identifier (`185497759670`) is authorized. #### Connect using Snowflake's PrivateLink integration To connect with Snowflake’s PrivateLink integration: 1. In Snowflake, call `SYSTEM$GET_PRIVATELINK_CONFIG`. Record the following values: * `privatelink-vpce-id`: This is your VPC Endpoint service name, formatted similarly to `com.amazonaws.vpce..vpce-svc-xxxxxxxxxx` * `privatelink-account-url`: This is your Snowflake PrivateLink account URL, formatted similarly to `..privatelink.snowflakecomputing.com` 2. Contact your Sigma Account Executive or Customer Account Manager to install your PrivateLink connection with Sigma and provide them with the service name and URL. Sigma will contact you once installation is complete. 3. Update your connection to use PrivateLink: * For existing connections to Snowflake: 1. Go to **Home** > **Administration** > **Connections**. 2. Select your existing connection, then select **Edit**. 3. In the **Account** field, enter the PrivateLink account URL you recorded in Step 1, following the format `..privatelink`. 4. Select **Save**. Existing connections will continue to work, but will not use PrivateLink until this step has been completed. * For new connections to Snowflake: Create a new connection using the steps in [Connect to Snowflake](/docs/connect-to-snowflake). When filling out the **Account** field, enter the PrivateLink account URL you recorded in Step 1, following the format `..privatelink`. ### Connect to Snowflake via your own VPC To connect to PrivateLink for Snowflake: 1. Create a VPC endpoint service. To create an endpoint service, see Create a service powered by AWS PrivateLink in the AWS documentation. 2. Make the newly created VPC endpoint service discoverable to Sigma. To make your endpoint discoverable, see Manage permissions in the the AWS documentation. You need Sigma’s Amazon Resource Name (ARN) to configure your endpoint service. Enter the following ARN in the **Allow principals** configuration of your VPC endpoint service: `arn:aws:iam::185497759670:role/cdktf-operator`. While existing configurations with `arn:aws:iam::185497759670:role/root configurations` will continue to work for all users, using `role/cdktf-operator` is recommended. 3. Contact your Sigma Account Executive or Customer Account Manager to install your PrivateLink connection. They will need the following: * Your endpoint’s VPC endpoint service name (formatted similarly to `com.amazonaws.vpce..vpce-svc-xxxx`). * Availability zone IDs of your load balancer (formatted similarly to `use1-az1`) . * Account URL (formatted similarly to `..privatelink.snowflakecomputing.com`). Installation can take up to a few days. Sigma will contact you once installation is complete, and will provide an account URL name for your connection (required for later configuration). 4. After installation, if your VPC Endpoint Service requires you to manually accept new connections, you will need to accept the new endpoint connection from Sigma. See Accept or reject connection requests in the AWS documentation. 5. Update your connection to use PrivateLink: * For existing connections to a data platform: 1. Go to **Home** > **Administration** > **Connections**. 2. Select your desired connection, then select **Edit**. 3. In the **Account** field, enter the account URL name provided to you by Sigma. 4. Select **Save**. Existing connections to data platforms will continue to work, but will not use PrivateLink until this step has been completed. * For new data platform connections: Connect to your data platform using the steps in [Connect to data sources](/docs/connect-to-data-sources). When filling out the **Account** field, use the new account URL provided to you by Sigma. ### Connect to a Snowflake internal stage Creating a PrivateLink to a Snowflake internal stage is supported. You might want to configure PrivateLink to an internal stage for several reasons, such as to ensure that traffic between Sigma and Snowflake does not travel over the public internet, or to meet safety and compliance requirements. **Additional prerequisites** * You must have a Snowflake internal stage configured. See the Snowflake documentation on Choosing an internal stage for local files for more information on Snowflake internal stages. * Your AWS account must be located in the same region as your Snowflake internal stage. To create a PrivateLink to your Snowflake internal stage: 1. Create an Amazon S3 interface endpoint for your Snowflake internal stage. See the Amazon documentation on Create a VPC endpoint. 2. From the AWS VPC console, obtain the **DNS Name** of your newly created VPC endpoint. See the Snowflake documentation on AWS configuration. 3. Use the Snowflake `S3_STAGE_VPCE_DNS_NAME` parameter to associate the endpoint DNS name with your Snowflake account. See the Snowflake documentation on S3\_STAGE\_VPCE\_DNS\_NAME. 4. Contact Sigma support or your Account Executive to configure the PrivateLink, and provide the following information: * Private internal stage URL (formatted as `.s3..amazonaws.com`) * DNS name of the S3 endpoint that they created (formatted as `*..s3..vpce.amazonaws.com`) Sigma will contact you once installation is complete. ## Redshift Connecting to Redshift via PrivateLink depends on your Redshift configurations: * If your Redshift cluster is the RA3-instance type and has cluster relocation turned on, Sigma recommends connecting via Redshift managed VPC endpoints. See [Connect with Redshift managed VPC endpoints](#connect-with-redshift-managed-vpc-endpoints). * If your Redshift cluster is not of RA3-instance type, has cluster relocation turned off, or if you prefer not to use Redshift managed endpoints, see [Connect to Redshift via your own VPC](#connect-to-redshift-via-your-own-vpc). ### Connect with Redshift managed VPC endpoints Redshift-managed VPC endpoints allow you to add additional security to your clusters without creating additional infrastructure. For more information, see Redshift managed VPC endpoints in the AWS documentation. #### Additional requirements * Have an existing Redshift instance. * The cluster to access must be the RA3-instance type. * The cluster to access must have cluster relocation turned on. See Relocating a cluster in the AWS documentation. #### Set up PrivateLink on Redshift managed VPC endpoints To set up Redshift managed VPC endpoints: 1. Authorize Sigma access to your Redshift instance. See Granting access to a VPC in the AWS documentation. The AWS account ID to grant access to is `185497759670`. Depending on the location of your Redshift cluster, grant access to the following VPC IDs: | Location | VPC ID | | :------------- | :---------------------- | | us-east-1 | `vpc-03e998398a2b8d7d4` | | us-east-2 | `vpc-0eb5c451f6d93b9b0` | | us-west-1 | `vpc-0b98df9ea218bbae3` | | us-west-2 | `vpc-0ebc060057f91792c` | | ap-southeast-2 | `vpc-0173a781cad403b87` | | ap-northeast-1 | `vpc-01d69d4176bf329d4` | | eu-central-1 | `vpc-03967ee832f14c234` | | eu-west-1 | `vpc-0ef690315d8c934e9` | | eu-west-2 | `vpc-0d89ee0ccf9f3eeb7` | If your Redshift cluster's region is not listed above, contact Sigma Support for assistance. 2. Provide the following information to Sigma: * The type of endpoint you want to create. One of: * `Redshift-Managed endpoint` * `VPC endpoint` * Redshift cluster identifier * AWS region of your Redshift cluster * AWS account number * Availability Zone ID(s): Formatted similarly to `use1-az1`. See Availability Zone IDs for your AWS resources in the AWS documentation. * \[optional] Desired DNS name: Your desired subdomain name for the private link account URL. The name should be descriptive and identifying. For example, you might want to format it similarly to `---`. Sigma will reach out after the private link has been created. ### Connect to Redshift via your own VPC 1. Create a VPC endpoint service. To create an endpoint service, see Create a service powered by AWS PrivateLink in the AWS documentation. 2. Make the newly created VPC endpoint service discoverable to Sigma. For instructions on how to make your endpoint discoverable, see Manage permissions in the AWS documentation. You will need Sigma’s Amazon Resource Name (ARN) to configure your endpoint service. Enter the following ARN in the **Allow principals** configuration of your VPC endpoint service: `arn:aws:iam::185497759670:role/cdktf-operator`. While existing configurations with `arn:aws:iam::185497759670:role/root configurations` will continue to work for all users, using `role/cdktf-operator` is recommended. 1. Contact your Sigma Account Executive or Customer Account Manager to install your PrivateLink connection. They will need the following: * The type of endpoint you want to create. One of: * `Redshift-Managed endpoint` * `VPC endpoint` * Your endpoint’s VPC endpoint service name (formatted similarly to `com.amazonaws.vpce..vpce-svc-xxxx`). * Availability zone IDs of your load balancer (formatted similarly to `use1-az1`) . * (Optional) Desired DNS name: Your desired subdomain name for the private link account URL. The name should be descriptive and identifying. For example, you might want to format it similarly to `---`. If you do not provide this value, Sigma Support will choose it and provide it to you. 2. After installation, if your VPC Endpoint Service requires you to manually accept new connections, you will need to accept Sigma’s new endpoint connection. For instructions, see Accept or reject connection requests in the AWS documentation. 3. Update your connection to use PrivateLink: * For existing connections to a data platform: 1. Go to **Home** > **Administration** > **Connections**. 2. Select your desired connection, then select **Edit**. 3. In the **Host** field, enter the DNS name from step 3 followed by `.privatelink.sigma.internal`. For example, `---.privatelink.sigma.internal`. 4. Select **Save**. Existing connections to data platforms will continue to work, but will not use PrivateLink until this step has been completed. * For new data platform connections: Connect to your data platform using the steps in [Connect to data sources](/docs/connect-to-data-sources). When filling out the **Host** field, enter the DNS name from step 3 followed by `.privatelink.sigma.internal`. For example, `---.privatelink.sigma.internal`. ## Databricks ### Additional requirements * Your Databricks platform must be Enterprise tier. * Your Databricks workspace **cannot** be in the `us-west-1` region. * Your Databricks workspace must be customer-managed, not Databricks-managed: * If you do not see a **Network** thumbnail when accessing your Databricks workspace, your workspace is Databricks-managed. * If you see a **Network** thumbnail when accessing your Databricks workspace, it is customer-managed. ### Connect to Databricks with PrivateLink To connect to Databricks with PrivateLink: 1. Create two VPC endpoints in your AWS account. See Create a VPC endpoint in the AWS documentation. For the endpoint service names needed to create VPC endpoints in your region, see the Databricks documentation on PrivateLink VPC endpoint services. You need to create: * One **Workspace (including REST API)** VPC endpoint * One **Secure cluster connectivity relay** VPC endpoint 2. In Databricks, you will need to register the 2 VPC endpoints you just created, so you can use them in your network configurations. See Manage VPC endpoint registrations in the Databricks documentation. 3. In Databricks, you will need to register the Sigma VPC endpoint for your region. See Manage VPC endpoint registrations in the Databricks documentation. Sigma's VPC endpoints are listed in the table below. If your region is not listed, contact your Sigma Account Executive or Customer Account Manager: | Region | WORKSPACE\_ACCESS Endpoint | | :------------- | :------------------------- | | us-east-2 | `vpce-01e5bcfb542cc064b` | | us-east-1 | `vpce-01e5ee810ad38e87a` | | us-west-2 | `vpce-0f7f1c9eb781e5ee0` | | ap-southeast-2 | `vpce-0ea8cc8aaac99003c` | | eu-central-1 | `vpce-042d25a7829e28994` | | eu-west-1 | `vpce-089a8efa3ea799d03` | | eu-west-2 | `vpce-0e2cc626d12fd41a5` | | ap-northeast-1 | `vpce-05a3ec6e4605fdd94` | 4. In Databricks, create a private access settings object to allow PrivateLink connectivity. See Create a private access settings object in the Databricks documentation. Ensure the following configurations are set: * **Public access enabled**: False * **Private access level**: Account 5. In Databricks, create a new network configuration. See Create a network configuration in the Databricks documentation. Ensure the following configurations are used: * Use the **VPC**, **Subnet IDs**, and **Security Group IDs** of your desired Databricks workspace. * For the **VPC endpoint for secure cluster connectivity relay** and **VPC endpoint for REST APIs fields**, use the AWS endpoints you created in your AWS account. 6. Update your Databricks workspace to include the new network configuration and private access settings. See Advanced configurations in the Databricks documentation. 7. Contact your Sigma Account Executive or Customer Account Manager to install your PrivateLink connection. They will need the following information about your Databricks workspace: * **Deployment name** (example: dbc-05a998877-123d) * **Workspace region** (example: us-east-1) Installation can take up to a few days. Sigma will contact you once installation is complete, and will provide an host URL for your connection. If you have multiple workspaces, you will need to provide the **Deployment name** for each workspace you want to connect to. If you add additional workspaces in the future, and want to connect to them through Sigma, you will need to request an update to your Sigma PrivateLink setup. 8. Update your connection to use PrivateLink: * For existing connections to a data platform: 1. Go to **Home** > **Administration** > **Connections**. 2. Select your desired connection, then select **Edit**. 3. In the **Host** field, enter the host URL provided to you by Sigma in step 7. The URL should end with `privatelink.databricks.com`. 4. Select **Save**. Existing connections to data platforms will continue to work, but will not use PrivateLink until this step has been completed. * For new data platform connections: Connect to your data platform using the steps in [Connect to data sources](/docs/connect-to-data-sources). When filling out the **Host** field, use the host URL provided to you by Sigma in step 7. ## MySQL, SQL Server 2022, PostgreSQL, Starburst, or custom proxy servers For organizations using MySQL, SQL Server 2022, Starburst, PostgreSQL, or a custom proxy server (e.g. secuPi), use the following steps to connect with AWS PrivateLink: 1. Create a VPC endpoint service. To create an endpoint service, see Create a service powered by AWS PrivateLink in the AWS documentation. 2. Make the newly created VPC endpoint service discoverable to Sigma. To make your endpoint discoverable, see Manage permissions in the AWS documentation. You will need Sigma’s Amazon Resource Name (ARN) to configure your endpoint service. Enter the following ARN in the **Allow principals** configuration of your VPC endpoint service: `arn:aws:iam::185497759670:role/cdktf-operator`. While existing configurations with `arn:aws:iam::185497759670:role/root configurations` will continue to work for all users, using `role/cdktf-operator` is recommended. 3. Contact your Sigma Account Executive or Customer Account Manager to install your PrivateLink connection. They will need the following: * Your endpoint’s VPC endpoint service name (formatted similarly to `com.amazonaws.vpce..vpce-svc-xxxx`). * Availability zone IDs of your load balancer (formatted similarly to `use1-az1`) . * (Optional) Desired DNS name: Your desired subdomain name for the private link account URL. The name should be descriptive and identifying. For example, you might want to format it similarly to `---`. If you do not provide this value, Sigma Support will choose it and provide it to you. 4. After installation, if your VPC Endpoint Service requires you to manually accept new connections, you will need to accept Sigma’s new endpoint connection. For instructions, see Accept or reject connection requests in the AWS documentation. 5. Update your connection to use PrivateLink: * For existing connections to a data platform: 1. Go to **Home** > **Administration** > **Connections**. 2. Select your desired connection, then select **Edit**. 3. In the **Host** field, enter the DNS name from step 3 followed by `.privatelink.sigma.internal`. For example, `---.privatelink.sigma.internal`. 4. Select **Save**. Existing connections to data platforms will continue to work, but will not use PrivateLink until this step has been completed. * For new data platform connections: Connect to your data platform using the steps in [Connect to data sources](/docs/connect-to-data-sources). When filling out the **Host** field, enter the DNS name from step 3 followed by `.privatelink.sigma.internal`. For example, `---.privatelink.sigma.internal`. ## Related resources * [Connect to data sources](/docs/connect-to-data-sources)