BASTION SSH TUNNEL FULL

Pro - Simple - requires no additional software.Pro - More secure: Limited connectivity for only the Redshift connection port and only to the Redshift master node.Con - More complex, requires installation and management of VPN Software or use of an AWS VPN Gateway to on-premise networks.

BASTION SSH TUNNEL FULL

Con - Can be less secure due to greater cage access, network bridging risk, and full access to cage for other users of the BI system.Pro - VPN User and key management functionality available from several VPN software providers.Pro - More flexible since this will include the client computer virtually within the Cage's public subnet, enabling access to selected private services within the Cage.Each of these methods have their own pros and cons:

Nucleator currently provides direct support for connectivity through a secure ssh tunnel. It is still possible to connect to a private Redshift cluster in one of two ways - establishing a VPN (virtual private network) connection to the Cage or connecting through a secure ssh tunnel. Most BI (Business Intelligence) tools will not be running inside of a customer Cage and in many cases the additional layer of security provided by a VPCs will be desired.

Private Redshift Cluster Connectivity from the Internet Either way it is advised that you test Redshift connection within the cage to ensure correct functionality. For some Redshift use models this level of connectivity may be all that is needed but for most use models Redshift connectivity from outside of the cage will be desired (see below). You can use the method above to test connections to Redshift clusters from other instances within the same Cage. If an error or no information is produced the connection to the Redshift cluster is not correct. No user data needs to be added to Redshift to view this information. This command should produce table descriptions for the first 5 informational tables. Psql -h -c 'SELECT * from information_schema.tables limit 5 ”

Bastion ssh tunnel