Product Documentation

Appearance

EE: All cloud platforms

Setting Up AWS Transit Gateway for Yellowbrick Access ​

Introduction ​

AWS Transit Gateway (TGW) is a highly scalable networking service that enables communication between multiple Amazon Virtual Private Clouds (VPCs). It simplifies connectivity and routing management across different VPCs, eliminating the need for complex peering configurations. In this guide, we will set up AWS Transit Gateway to enable Tableau access to a Yellowbrick instance hosted in an Amazon Elastic Kubernetes Service (EKS) cluster.

NOTE: This guide uses Tableau as an example service in the Hub VPC. This process, however, is similar regardless of service.

Why Use Transit Gateway? ​

  • Centralized Connectivity: Instead of managing multiple peering relationships, Transit Gateway allows a single connection hub, making management easier.
  • Scalability: Supports thousands of VPCs, simplifying large-scale cloud networking.
  • Improved Security: Traffic routing and security policies can be centrally managed.
  • Reduced Complexity: Eliminates the need for complex route table configurations across multiple VPCs.

Prerequisites ​

Before proceeding, ensure the following requirements are met:

  • Source VPC (Tableau VPC) contains Tableau deployed in a private subnet.
  • Target VPC (Yellowbrick VPC) hosts the Yellowbrick instance within EKS across two private subnets.
  • Connectivity Method: AWS Transit Gateway.
  • Required Ports:
    • Inbound to Yellowbrick Instance (Target VPC, EKS Private Subnets):
      • 80, 443, 5432, 11111, 11112, 31000, 31001.
    • Outbound from Tableau (Source VPC, Private Subnet):
      • 80, 443, 5432, 11111, 11112, 31000, 31001, 1024-65535.

1. Create a Transit Gateway ​

  1. Navigate to AWS Console → VPC Dashboard.
  2. Select Transit Gateways → Create Transit Gateway.
  3. Provide the following details:
    • Name: tableau-to-yellowbrick-tgw.
    • Amazon ASN: Choose or leave as default.
    • DNS Support: Enabled.
    • Auto-Attach VPCs: Disabled (manual attachment recommended for better control).
  4. Click Create Transit Gateway.

2. Attach VPCs to the Transit Gateway ​

Attach Source VPC (Tableau VPC) ​

  1. Go to AWS Console → VPC Dashboard.
  2. Select Transit Gateway Attachments → Create Transit Gateway Attachment.
  3. Enter the following details:
    • Transit Gateway ID: tgw-xxxxxxxxxxxxxxxxx.
    • VPC ID: vpc-xxxxxxxxxxxxxxxxx (Source VPC).
    • Subnet IDs: Select the private subnets where Tableau is deployed.
  4. Click Create Attachment.

Attach Target VPC (Yellowbrick Instance VPC) ​

Repeat the same steps for the Target VPC, providing:

  • VPC ID: vpc-xxxxxxxxxxxxxxxxx (Target VPC - Yellowbrick Instance).
  • Subnet IDs: Select the private subnets where Yellowbrick Instance is deployed.

3. Update Route Tables ​

  1. Go to VPC Dashboard → Route Tables.
  2. Identify the route table associated with Tableau’s private subnet.
  3. Click Routes → Edit Routes.
  4. Add a new route:
    • Destination: 10.x.x.x/xx (Target VPC CIDR).
    • Target: Transit Gateway (tgw-xxxxxxxxxxxxxxxxx).
  5. Click Save Routes.

Repeat these steps for the Target VPC’s route table:

  • Destination: 10.x.x.x/xx (Source VPC CIDR).
  • Target: Transit Gateway (tgw-xxxxxxxxxxxxxxxxx).

4. Configure Security Groups ​

  1. Navigate to EC2 Dashboard → Security Groups.
  2. Locate the security group attached to the EKS cluster or Yellowbrick Instance.
  3. Click Inbound Rules → Edit inbound rules.
  4. Add the required inbound rules.
  5. Click Save Rules.
  6. Edit Outbound Rules to allow communication back to Tableau.
  7. Click Save Rules.

5. Verify Connectivity ​

  1. SSH into the Tableau Server (Source VPC Private Subnet).
  2. Test connectivity to Yellowbrick Instance in the Target VPC using nc or telnet:
    sh
    nc -zv 10.x.x.x 5432  # Check PostgreSQL connection
nc -zv 10.x.x.x 80    # Check HTTP connection
nc -zv 10.x.x.x 443   # Check HTTPS connection
  3. If tests fail, review security group settings, route tables, and DNS resolution.

6. Summary ​

✅ Transit Gateway Created
✅ VPCs Attached to Transit Gateway
✅ Route Tables Updated in Both VPCs
✅ Security Groups Configured to Allow Required Ports
✅ Connectivity Verified via Network Tests

7. Troubleshooting ​

If connectivity issues persist, check the following:

  1. Transit Gateway Attachment Status - Ensure attachments are available in the AWS Console.
  2. Route Table Misconfigurations - Confirm that both Source and Target VPCs have the correct routes.
  3. Security Group Rules - Verify that inbound/outbound traffic is allowed for the required ports.
  4. NACL Restrictions - Ensure that both inbound and outbound rules are correctly configured.
  5. Firewall Rules (Local or External) - Ensure firewalls are not blocking traffic.
  6. Use AWS Network Analyzer - To identify connectivity issues between VPCs:
    • Navigate to AWS Console → VPC Dashboard → Network Analyzer.
    • Create a new network path analysis between Source VPC (Tableau) and Target VPC (Yellowbrick Instance in EKS).
    • Validate routes, security groups, and network ACLs to identify any misconfigurations.

By following this guide, you will successfully configure AWS Transit Gateway to enable Tableau access to a Yellowbrick instance in an EKS cluster. 🚀