# AWS outlines private Amazon Quick access with PrivateLink

- Source: MechNext — https://mechnext.eu/en/article/48-aws-outlines-private-amazon-quick-access-with-privatelink
- Published: 2026-10-22
- Updated: 2026-10-22
- Category: Industry News
- Language: en (Markdown in other languages: ?lang=de, ?lang=sk, ?lang=pl, ?lang=zh, ?lang=ru)

> AWS separates user access through VPC endpoints from connections to private data sources. Its walkthrough covers DNS, identity, access controls and the exceptions that still require public connectivity.

AWS describes an architecture for connecting Amazon Quick to corporate networks with AWS PrivateLink. Quick combines search, analytics, research and automation. The design separates two traffic paths: VPC endpoints carry website, API, embedded-content and Desktop traffic, while VPC connections carry server-side requests to private data sources and internal APIs.

### Network foundations and DNS

The walkthrough assumes an existing Direct Connect or Site-to-Site VPN connection between the corporate network and a VPC. Prerequisites include Quick Enterprise, a VPC in the Quick deployment Region, DNS administration access and the relevant IAM permissions. Quick website VPC endpoints are unavailable in AWS China and AWS GovCloud (US) Regions.

Website and supported API access use the interface endpoints `com.amazonaws.<region>.quicksight-website` and `com.amazonaws.<region>.quicksight`. Endpoint network interfaces should span at least two Availability Zones, with corporate routes and restrictive security groups. The website needs an A alias for `<region>.quicksight.aws.amazon.com`, resolved through a Route 53 Resolver inbound endpoint or an equivalent corporate DNS record. API private DNS redirects existing API calls automatically.

API coverage has exceptions. The endpoint excludes eight action connector APIs plus GetFlowMetadata, GetFlowPermissions, ListFlows, SearchFlows and UpdateFlowPermissions. Automation managing these resources needs public API connectivity. Administrators signing in as IAM users through the VPC also need the `console` and `signin` endpoints.

### A separate path to private data

Quick Sight queries private databases through VPC network interfaces, or ENIs. Flows, Automate and Agents can invoke private action connectors, MCP servers or internal APIs; Research uses VPC connections for private sources. Apps inherit connectivity from Sight and Flows, while Spaces initiate no data connections. Quick Index knowledge base VPC connections support only Redshift. S3 bucket endpoint restrictions are a separate mechanism.

A VPC connection requires an immutable VPC ID, an execution role, at least two subnets in different Availability Zones and a security group. Quick does not create the role: it needs EC2 ENI permissions and trust for `quicksight.amazonaws.com`. Private DNS resolvers are optional. Routing, network ACLs and security groups govern the ENIs. Connections created before April 27, 2023 need explicit return-traffic ingress on ports 0–65535. A PARTIALLY AVAILABLE connection remains usable.

Private calls to S3, Redshift, Athena and Secrets Manager require their service endpoints in the VPC containing Quick ENIs. Athena is not a VPC connection data source; its endpoint protects API traffic. Browsers still need outbound access to unsupported external domains. IAM Identity Center browser authentication needs public AWS sign-in and Identity Center endpoints through a proxy or NAT, without requiring public IP addresses on clients.

### Access controls and identity

Endpoint policies can restrict access by AWS account or organization. Website policies require Principal, Action and Resource to equal `*`, with conditions limited to `aws:PrincipalAccount` or `aws:OrgId`. Only API endpoint policies support action-level restrictions. AWS recommends limiting endpoint HTTPS ingress to corporate CIDRs.

Quick access restrictions accept IP ranges, VPC IDs or endpoint IDs, with up to 100 combined rules; matching either rule type permits access. They cover web, embedded and mobile access. Public API restrictions require IAM `aws:SourceIp` or `aws:SourceVpce` conditions. Rules apply across Regions, are managed in the account's creation Region and can take ten minutes to apply. UpdateIpRestriction replaces the entire rule map, so administrators must preserve their own access before enforcement.

IAM Identity Center provides SAML 2.0 authentication and SCIM 2.0 user and group provisioning. Admin, Author and Reader roles define baseline capabilities. Custom user permissions override role permissions, which override account permissions; Spaces add user and group segmentation. Sight row-level security maps identities to permitted field values and governs both dashboards and AI natural-language queries. Column-level security hides selected columns from specified users or groups.

AWS recommends validating access before enforcement, using Flow Logs on selected ENIs and monitoring ActiveConnections, BytesProcessed and PacketsDropped in CloudWatch. It also recommends quarterly policy reviews, AWS Config drift detection and separate connections by environment. Cost guidance includes free S3 gateway endpoints, consolidating ENI placement and comparing targeted proxy costs with NAT gateway access.