Azure Private Link Connections
This document explains how to connect Sigma to your data warehouse that's hosted on Azure using Azure's Private Link.
See Sigma's Azure Private Link lab for more information on how to establish a secure connection between Sigma and an Azure data warehouse.
Summary of Content
Requirements
Introduction
Create Private Link Connection for Your Data Warehouse
Snowflake
Provide Snowflake Info to Sigma
Configure Snowflake Connection
Databricks
Provide Databricks Resource ID to Sigma
Private Link Approval
Configure Databricks Connection
PostgreSQL
Provide PostgreSQL Info to Sigma
Private Link Approval
Configure PostgreSQL Connection
Requirements
- A Sigma organization running on Azure.
- Admin privileges in your Sigma organization; see User account types.
- Snowflake, Databricks, or PostgreSQL Admin, depending on the data warehouse
- Azure Admin
Introduction
Sigma organizations running on Azure can securely connect to their data using Azure's Private Link, which allows Sigma to access the data warehouse hosted on Azure via a private endpoint in the virtual network. This not only enhances security during data transit but also improves performance by reducing network latency. With Private Link, Sigma connects to the data warehouse using private IP addresses, ensuring traffic never leaves the Microsoft network and data remains secure without exposure to the internet.
To utilize Private Link, create a private endpoint in your virtual network that maps to the data warehouse, assign it a private IP address, and connect to the warehouse using this address.
Sigma supports connections to the following data warehouses on Azure:
- Snowflake
- Databricks
- PostgreSQL
Create Private Link Connection for Your Data Warehouse
Follow the steps below to create a Private Link connection to your data warehouse hosted in Azure.
To initiate this process, the first step for all data warehouses is to retrieve the required information and send to your account manager.
Snowflake
Provide Snowflake Info to Sigma
Follow the steps below to provide Sigma with the requisite information to create a Private Link for your organization.
Your Snowflake account must be Business Critical tier to use Private Link.
-
In the Snowflake SQL console, execute the following command:
select system$get_privatelink_config();
-
Below is the output from the SQL query. In the example above, the output is highlighted in blue.
{"regionless-snowsight-privatelink-url":"app-br67048-sigma_azure_us_east_2.privatelink.snowflakecomputing.com",
"privatelink-account-name":"os99982.east-us-2.privatelink",
"snowsight-privatelink-url":"app.east-us-2.privatelink.snowflakecomputing.com",
"privatelink-account-url":"os99982.east-us-2.privatelink.snowflakecomputing.com",
"privatelink-pls-id":"sf-pvlinksvc-azeastus2.cf82bce2-bw2d-4dw2-92ee-3dw2fb04d191.eastus2.azure.privatelinkservice",
"regionless-privatelink-account-url":"br67048-sigma_azure_us_east_2.snowflakecomputing.com",
"privatelink_ocsp-url":"ocsp.os99982.east-us-2.privatelink.snowflakecomputing.com",
"privatelink-connection-urls":"[]"}In the output field, copy the values for
privatelink-pls-id
andprivate-account-url
. In the example above, the values are coded red.In the example above,
private-pls-id
issf-pvlinksvc-azeastus2.cf82bce2-bw2d-4dw2-92ee-3dw2fb04d191.eastus2.azure.privatelinkservice
and
private-account-url
isos99982.east-us-2.privatelink.snowflakecomputing.com
- Send these two values to your Sigma account manager.
- Sigma will create a Private Link and alert you when the link is active.
You can't configure the connection until Sigma creates the Private Link.
Configure Snowflake Connection
Follow the steps below to configure your Sigma Snowflake connection to use Private Link.
- Once the private link is active, in Sigma go to Admin > Connections > Snowflake.
- Click Create to create a Snowflake connection.
- In the Account field, enter the three parts of the account URL in this format:
<account>.<region_id>.privatelink
For example, if the account URL istest123.west-us-2.privatelink.snowflakecomputing.com
Then the Account field will betest123.west-us-2.privatelink
-
Under Warehouse, enter your warehouse’s name as listed in Snowflake.
- If you have OAuth enabled on your organization, and you would like to use it on the connection, switch on OAuth access; see OAuth with Snowflake.
Please note: Steps 9 - 11 are not applicable if you choose to use OAuth without a service account. - Under User, enter your Snowflake username.
- Under Password, enter your Snowflake password.
-
[optional] Under Role, you can specify a Snowflake role to be used on this connection.
- [optional] Under Connection Features, you can set a connection timeout and/or enable write access.
- After completing the form, click the Create button.
Databricks
Prerequisites
- You must create an Azure Databricks workspace.
- Your Databricks workspace must be Premium tier.
- A customized networking configuration is required to support Private Link.
Provide Databricks Resource ID to Sigma
Follow the steps below to provide Sigma with the Resource ID to create a private link for your organization.
- In Azure Services, hover over Azure Databricks and click Create.
- Click JSON View in the top-right corner of the databricks workspace page in Azure.
- On the Networking tab, you must check Yes for Deploy Azure Databricks workspace in your own Virtual Network and enter pre-configured virtual network and two subnets within the virtual network CIDR range for public and private subnet fields.
- Copy the Resource ID. In Location, copy the Region Name for the Databricks warehouse. Send these two values to your Sigma account manager.
Private Link Approval
Follow the steps below to approve the Private Link after Sigma notifies you.
- In the Azure portal, go to Azure Databricks.
- Click the selected Azure Databricks workspace.
- Click Networking on the left panel.
- Click on Private endpoint connections.
- Select the newly created private endpoint. The status will be Pending. Check Approve to approve the endpoint. Copy the name of the private endpoint, it's required when you configure Sigma.
Configure Databricks Connection
- In the Databricks section of Azure, click on the warehouse instance > Databricks Workspace.
- Click Launch Workspace.
- In Databricks, select SQL in the Data Science & Engineering dropdown.
- Click Review SQL Warehouses.
- Select the warehouse.
- Click the Connection details tab.
- Copy the HTTP path value in Databricks as it's required in the Sigma UI.
- Go to User Settings in Databricks by clicking on your username.
- Click Personal access tokens tab.
- Click Generate new token.
- In the Lifetime field, set the duration of the private link. The link will expire based on the value.
- Enter a value in the Comment field.
- Click Generate. Copy this token as it's required in the Sigma UI.
- In Sigma, go to Admin > Connections > Databricks.
- In the Host field, enter the private endpoint you copied when you approved the endpoint, in the following format.
For example, if the private endpoint name is databricks-endpoint, then you would enter the following in the Host field.<private_endpoint_name>.pl-auth.azuredatabricks.net
databrick-endpoint.pl-auth.azuredatabricks.net
To locate the private endpoint's name, go to your Azure portal > click the Azure Databricks Workspace > click Networking on the left panel. The private endpoint name is displayed in the Private Endpoint column in Private endpoint connections.
- Paste the HTTP path value from Azure into the HTTP path field in Sigma.
- Paste the token you created in Azure and enter into Access token field in Sigma.
-
[optional] Under Connection Features, you can set a connection timeout and/or enable write access.
- [optional] In the Connection queue size field, define the number of interactive queries Sigma can run on this connection concurrently.
- Click Create in Sigma.
PostgreSQL
Prerequisites
- To create a Private Link connection to PostgreSQL in Azure, the postgres server must be a single server, not a flexible server.
- Your PostgreSQL instance must be General Purpose tier.
Currently, Azure only supports creating a Private Link to Azure Database for PostgreSQL single server (Resource Type).
Provide PostgreSQL Info to Sigma
Follow the steps below to provide Sigma with the Resource ID to create a private link for your organization.
-
Click the JSON View on the top-right corner of PostgreSQL server page in your Azure portal.
- Copy the Resource ID and send to your Sigma account manager.
Private Link Approval
Follow the steps below to approve the Private Link provided by Sigma.
- In Azure, go to Azure Database for PostgreSQL servers.
- Click on the selected PostgreSQL server created by the private link.
- Click on Private endpoint connections on the left panel of the PostgreSQL server page. Copy the name of the private endpoint as you will need it when you configure Sigma.
- Select the recently created private endpoint connection
- The status will be Pending. Check Approve to approve the endpoint.
- The private endpoint connection will change to Accepted.
Configure PostgreSQL Connection
Follow the steps below to configure your Sigma PostgreSQL connection to use Private Link.
-
In the Host field, enter the private endpoint you copied in the step above in the following format:
<private_endpoint_name>.privatelink.sigma.internal
For example, if the private endpoint name is
postgresql-endpoint
, then the Server field is:postgresql-endpoint.privatelink.sigma.internal
- In the User field, enter the Admin Username found in the PostgreSQL server page. For example, user@postgres_test.
- In the Port field, enter the PostgreSQL port number.
- In the Password field, enter the password used to access your data warehouse.
- In the Database field, enter the name of your database.
- Toggle Enable DNS on to ensure encryption.
- [optional] SSH isn't required for this connection.