---
schema_version: "1"
id: 8bc23007c18dad2394ca5685d5438cb5795a90f9f8a4c2042bf37be638324436
title: Add a Private Network Route for Redshift
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/data/264-0-0/c360_a_private_connect_redshift.md
canonical_url: https://help.salesforce.com/s/articleView?id=data.c360_a_private_connect_redshift.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 8fce587df0ae2665c3bd84f09ecfa3f9d3b778593d005c404a35ba13291e1ab2
description: To enable federation connections, connect your Redshift data source and your Data Cloud tenant with a dedicated network route using Private Connect for Data Cloud. Private Connect supports self-managed PrivateLink. Redshift-managed PrivateLink isn't currently supported.
products:
  - Data 360
release: "264"
---
# Add a Private Network Route for Redshift

To enable federation connections, connect your Redshift data source and your Data Cloud tenant with a dedicated network route using Private Connect for Data Cloud. Private Connect supports self-managed PrivateLink. Redshift-managed PrivateLink isn't currently supported.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All Editions</strong> supported by Data 360. See <a href="https://help.salesforce.com/s/articleView?id=data.c360_a_dc_editions.htm&amp;release=264.0.0&amp;type=5" title="Data 360 is available in several supported Salesforce editions. Some Data 360 features also require additional licenses.">Data 360 edition availability</a>.</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:left;vertical-align:top;" id="d75261e67">User Permissions
              Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d75261e67 ">To create a Redshift network route</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d75261e67 ">
              <p>Data Cloud Architect permission set OR</p>
              <p style="margin-bottom:0;">Manage External Connections or
                Customize Application permissions</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d75261e67 ">To administer an Amazon Web Services (AWS) environment</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d75261e67 ">AWS account administrator</td>

          </tr>
        </tbody>
      </table>

- Configure a PrivateLink endpoint service for your Redshift cluster.
- Verify the Security Group rules can accept traffic from the Network Load Balancer (NLB) created for this endpoint service.
- Verify that the target group is connected to the NLB so that the NLB knows where to route requests.
- Make sure that the security group associated with the NLB allows inbound traffic on port 5439 port.
- If your Redshift and Data Cloud instances are in different regions, verify that the region of your Data Cloud instance is selected under **Supported Regions**.
- The Data Cloud virtual private cloud (VPC) endpoint ID and Data Cloud DNS Name are available on the details page of the network route after it's provisioned. In some case you may need to modify your network policy to include the Data Cloud VPC endpoint ID. An alternative method is to add the internal IP address range 10.0.0.0/8 to your network policy's allowed list. This reserved address range is specifically designated for private networks and allows traffic to originate from a wide range of private Data Cloud IP addresses.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-data-data_cloud-264-0-0-production-enus/f3569962-3c9b-4f83-9d0c-b6a574e785da/images/icon_note.png)

Note

Private Connect isn’t required to share data from Data Cloud to Redshift.

See the AWS Big Data Blog series for more information:

- Part 1: For Data Federation, see [Harness Zero Copy data sharing from Salesforce Data Cloud to Amazon Redshift for Unified Analytics](https://aws.amazon.com/blogs/big-data/harness-zero-copy-data-sharing-from-salesforce-data-cloud-to-amazon-redshift-for-unified-analytics-part-1/)
- Part 2: For Data Share, see [Zero Copy data sharing from Salesforce Data Cloud](https://aws.amazon.com/blogs/big-data/harness-zero-copy-data-sharing-from-salesforce-data-cloud-to-amazon-redshift-for-unified-analytics-part-2/)
- Part 3: For Private Connect for Data Cloud, see [Enhance Agentforce data security with Private Connect for Salesforce Data Cloud and Amazon Redshift](https://aws.amazon.com/blogs/big-data/enhance-agentforce-data-security-with-private-connect-for-salesforce-data-cloud-and-amazon-redshift-part-3/)

1. From the **App Launcher**, select **Data Cloud**.
2. From **Setup**, select **Data Cloud Setup**.
3. From **Data Cloud Setup**, expand **Admin Tools** and select **Private Connect**.
4. Click **New**.
5. Select **Redshift**, and click **Setup**.
6. For Step 1, add the Principal ID to your AWS VPC endpoint service:
    1. Copy the generated Principle ID.
    2. Go to your AWS account.
    3. Under Virtual private cloud, select **Endpoint services**.
    4. Select the check box next to the Service ID of the VPC endpoint service.
    5. On the Allow principals tab, click **Allow principals**.
    6. In the Principals section, paste the principal Amazon Resource Name (ARN) that you copied earlier.
    7. Click **Allow principals**.
7. In your AWS account, select the VPC endpoint service that you want to use to access your Redshift cluster.
    1. Under Virtual private cloud, select **Endpoint services**.
    2. Select the relevant endpoint service.
    3. Go to the Details tab and copy the Service name.
        
        The Service name is in the format of: `com.amazonaws.vpce.<region>.<account_ID>`
8. For Step 2, in the Configure Amazon Redshift Private Network Route page:
    1. Enter a name and an API name for the network route and the network API name.
        
        You can’t change the route name after you save it.
    2. (Optional) Enter a description for the network route.
    3. Paste the name of your VPC endpoint service in the format: `com.amazonaws.vpce.<region>.<account_ID>`
    4. Click **Save**.
9. In the AWS VPC dashboard, accept the network connectivity request.

The Data Cloud VPC endpoint ID and Data Cloud DNS Name are available on the details page of the network route after it's provisioned. In some case you may need to modify your network policy to include the Data Cloud VPC endpoint ID.

When the network provisioning completes successfully, you can create a federated connection for Redshift. There can be a brief delay before you can create a federated connection or data share due to DNS configuration.

#### See Also

- [_Salesforce Help_: Set Up a Redshift Federation Connection for Private Connect](https://help.salesforce.com/s/articleView?id=data.c360_a_set_up_a_redshift_federation_connection_for_private_connect.htm&release=264.0.0&type=5 "Set up a connection between Redshift and Private Connect for Data Cloud to access the data.")