Connectivity Options

By default, Sifflet connects to your sources over the public Internet. Sifflet supports a variety of more specialized networking setups for organizations with stricter requirements.

📘
Feature availability
Depending on your plan, some of these features might not be available. Contact your account executive to learn more.
If you have special requirements around connectivity to your sources, let Sifflet know before your Sifflet instance is created. This allows Sifflet to provision your instance in a suitable cloud provider and region, minimizing both setup and ongoing network costs.

IP Allowlisting

From Sifflet to Sources

Sifflet instances make connections to your sources using dedicated, stable IP addresses. Many vendors implement a feature allowing you to block all traffic except when coming from a known IP range.

For instance:

Snowflake users can deploy Snowflake network policies.
Databricks users can deploy IP access lists.
Looker users can deploy IP Allowlists.

Using such features, you can block traffic to your source, except when coming from your network, Sifflet, or any service you use.

The list of IP addresses used by your Sifflet instance is available from the Settings > Integration Preferences page.

From Your Network to Sifflet

Sifflet can restrict access to the Sifflet API of your instance from the IP ranges of your corporate networks.

This prevents any user or service not located on your corporate network from using the Sifflet API. This also prevents any user not using your corporate network from using the Sifflet web UI.

Contact Sifflet support if you're interested in this feature.

AWS Private Link

Sifflet can enable AWS Private Link between your Sifflet instance and sources located on the AWS network. This means that traffic between Sifflet and the source doesn't leave the AWS network and is not routed over the public Internet.

Snowflake on AWS

Requirements:

You use the Business Critical edition of Snowflake (or higher).
Your Snowflake account is deployed on AWS.
Your Sifflet instance is deployed on AWS (which is the default).
Your Sifflet instance is located in the same AWS region as your Snowflake account.

Process

Run the following command in your Snowflake account and note the result:
```
SELECT SYSTEM$GET_PRIVATELINK_CONFIG();
```
Ask Sifflet support to enable AWS Private Link to your Snowflake account. Provide the output of the command in the previous step. Sifflet answers with a Sifflet-owned AWS account ID.
Ask Snowflake support to allow the AWS account ID provided by Sifflet to establish Private Link connections.
Ask Sifflet support to finalize the setup.

📘
Snowflake account identifiers and Private Link
When using AWS Private Link, the account identifier you configure in Sifflet changes. Use the "privatelink-account-name" returned by SELECT SYSTEM$GET_PRIVATELINK_CONFIG();, not the public Snowflake account name.

AWS Redshift and Redshift Serverless Using Redshift-Managed Endpoints

Requirements

Your Sifflet instance is deployed on AWS (which is the default).
Your Sifflet instance is located in the same AWS region as your Redshift instance.
- If this requirement is not satisfied, you can still configure an AWS Private Link to your Redshift cluster by deploying a network load balancer. Refer to the Other section below.
Your Redshift instance complies with the requirements outlined in the AWS documentation.
- If some of these requirements are not satisfied, you can still configure an AWS Private Link to your Redshift cluster by deploying a network load balancer. Refer to the Other section

Process

Ask Sifflet support to enable AWS Private Link for your Redshift cluster. Provide Sifflet support with your:
- Redshift cluster identifier or Redshift Serverless workgroup
- AWS account ID
Sifflet support answers with an AWS account ID and virtual private cloud (VPC) IDs.
Allow the VPC IDs provided by Sifflet to access your Redshift instance, by following the AWS documentation. Once done, ask Sifflet support to proceed.
Sifflet provides you with the Private Link endpoint names to use in your Sifflet configuration.

Other

If you run a source in a private subnet (such as a private Amazon Relational Database Service (RDS) database), Sifflet can also connect to this source using Private Link. The exact setup depends on the source and your network architecture. Contact Sifflet support to design a solution.

The overall process typically looks like this:

You create an AWS Network Load Balancer (NLB) in front of your source
You create an endpoint service pointing to this NLB
You grant the Sifflet AWS account permissions to request access to this endpoint service
You accept the Sifflet connection request, and use the hostnames provided by Sifflet in your Sifflet configuration

Azure Private Link

Snowflake on Azure

Requirements:

You use the Business Critical edition of Snowflake (or higher).
Your Snowflake account is deployed on Azure.
Your Sifflet instance is deployed on AWS (which is the default).
Your Sifflet instance is deployed in an AWS region that's compatible with the region where your Azure Snowflake account is deployed. Contact Sifflet for more details.

Process

Run the following command in your Snowflake account and note the result:
```
SELECT SYSTEM$GET_PRIVATELINK_CONFIG();
```
Ask Sifflet support to enable Azure Private Link to your Snowflake account. Provide the output of the command in the previous step. Sifflet answers with an endpoint ID.
Ask Snowflake support to allow the endpoint ID provided by Sifflet to establish Private Link connections.
Ask Sifflet support to finalize the setup.

📘
Snowflake account identifiers and Private Link
When using Azure Private Link, the account identifier you configure in Sifflet changes. Use the "privatelink-account-name" returned by SELECT SYSTEM$GET_PRIVATELINK_CONFIG();, not the public Snowflake account name.

Azure Synapse

Requirements

Your Sifflet instance is deployed on AWS (which is the default). Sifflet establishes virtual private network (VPN) connections to Azure virtual networks (VNets), then creates the Private Link between a Sifflet-managed Azure VNet and your Synapse workspace.
Your Sifflet instance is in an AWS region where Sifflet enabled connectivity to Azure. Contact Sifflet support to learn more, providing details about the Azure region in which your Synapse workspace is located.

Process

Ask Sifflet support to enable Azure Private Link, providing
- Your Azure subscription ID
- The resource group name in which your Synapse workspace is located
- Your Synapse workspace name
Once instructed by Sifflet support, go to Private endpoint connections and accept the Sifflet connection request. Sifflet provides you with the hostname to configure in your Sifflet instance to connect to this workspace.

Azure Databricks

Requirements

Your Sifflet instance is deployed on AWS (which is the default). Sifflet establishes VPN connections to Azure VNets, then creates the Private Link between a Sifflet-managed Azure VNet and your Databricks workspace.
Your Sifflet instance is in an AWS region where Sifflet enabled connectivity to Azure. Contact Sifflet support to learn more, providing details about the Azure region in which your Databricks workspace is located.

Process

Ask Sifflet support to enable Azure Private Link, providing
- Your Azure subscription ID
- The resource group name in which your Databricks workspace is located
- Your Databricks workspace name
Once instructed by Sifflet support, go to Private endpoint connections and accept the Sifflet connection request. Sifflet provides you with the hostname to configure in your Sifflet instance to connect to this workspace.

Other Networking Requirements

Contact Sifflet support or your account executive to discuss any networking setup not covered in this page. Thanks to its single-tenant architecture, Sifflet can accommodate many customized networking requirements (also see https://docs.siffletdata.com/docs/security).