About This Architecture

Cross-account QuickSight to Aurora architecture using AWS Transit Gateway for secure, centralized connectivity between Analytics and Data Platform accounts. QuickSight ENIs in Analytics VPC (10.1.0.0/16) route through Transit Gateway to Aurora PostgreSQL clusters in Data Platform VPC (10.2.0.0/16), with strict security groups limiting access to 10.1.0.0/16 CIDR only. This pattern isolates analytics workloads from data infrastructure while maintaining encrypted TLS 1.2+ connectivity, automated backups via AWS Backup, and comprehensive observability through VPC Flow Logs, CloudWatch, and CloudTrail. Fork this diagram on Diagrams.so to customize subnets, add additional accounts, or adapt for your multi-region strategy. The design demonstrates least-privilege networking with Network ACLs, Secrets Manager credential rotation, and KMS encryption at rest—essential for regulated analytics environments.

People also ask

How do I securely connect QuickSight in one AWS account to Aurora in another account using Transit Gateway?

Use AWS Transit Gateway shared via Resource Access Manager to route traffic between Analytics VPC (QuickSight ENIs) and Data Platform VPC (Aurora clusters). Enforce least-privilege security groups allowing only 10.1.0.0/16 CIDR to port 5432, encrypt credentials in Secrets Manager, enable KMS at-rest encryption, and monitor with VPC Flow Logs and CloudTrail for compliance.