Bridge + private VPC Redshift — scheduled extract refresh fails for embedded data sources published via web UI. Is Desktop inside the VPC the only option?

Question

Hi all, hoping someone who's been through this can sanity-check our approach before we provision more infrastructure.

What we're trying to do

We have 10+ existing production dashboards on Tableau Cloud that currently point at a publicly-accessible Redshift cluster. We're migrating them to a new Redshift cluster that sits inside a private AWS VPC. The dashboards have to stay exactly as they are - same layout, calcs, filters. Rebuilding from scratch isn't an option at the moment.

What's working

Bridge is set up and healthy:

Dedicated pool created (not the default pool), status Ready
Bridge client installed on an EC2 inside the VPC, connected, assigned to the pool
Redshift host in the Private Network Allowlist, mapped to that pool
Security group on the cluster allows 5439 from the Bridge instance
Credentials verified — can browse schemas and tables through the connection

Changing the connection and creating an extract from within the Tableau Cloud workbook editor works fine, and the job details confirm it routed through Bridge.

What's failing

Every scheduled or manual extract refresh fails with:

This server violates the ip allowlist/blocklist restrictions
Unable to connect to the Amazon Redshift server "<our-cluster>.<our-region>.redshift.amazonaws.com"

We tried deleting and recreating the schedule, reassigning the Bridge client to the pool, and reverifying the allowlist mapping. Same result every time.

What we think is going on

From the Limitations section of the embedded data sources doc (

help.tableau.com/current/online/en-us/to_bridge_eds.htm

), workbooks published via the REST API or uploaded through the Tableau Cloud web interface don't support Bridge refreshes when data sources are embedded. Ours was published using "Publish As" from web authoring, so we think that's the cause. The documented workarounds are to publish from Tableau Desktop, or publish the data source separately and connect the workbook to it.

Where we've got stuck

We hit three walls trying to follow those workarounds:

Repointing an existing workbook to a published data source is a Replace Data Source operation, and per the docs that's Tableau Desktop only, not available in Tableau Cloud.
We can't publish one of our two data sources separately (for one of our workbooks but there are some other as well in similar structure) anyway, Desktop greys it out with "Data sources with calculations that reference other data sources must be embedded."
We installed Tableau Desktop and the Amazon Redshift ODBC 2.x driver locally and tried connecting directly. It times out. An nslookup shows the hostname resolves to a private IP via a VPC endpoint, so the cluster genuinely isn't reachable from outside the VPC. No firewall or SG change fixes that, if I am not wrong.

Our workbook is also 63 MB, over the 50 MB web upload limit, so uploading through the web UI isn't an option regardless.

Questions

Has anyone confirmed that publishing a workbook from Tableau Desktop actually resolves the embedded-data-source Bridge refresh issue when the source is in a private VPC specifically? The docs say it should, but we haven't validated it end-to-end yet and don't want to build infrastructure on an assumption.
Is running Tableau Desktop on a VM inside the VPC the normal approach for this, or is there a cleaner pattern we're missing?
Is there any supported way to repoint an existing workbook from an embedded data source to a published data source without Desktop?
More generally, if you've migrated a set of existing workbooks to a private VPC data source, what did your process actually look like? Trying to settle on the right pattern before repeating it 10+ times.

Happy to share more detail if useful. Thanks in advance.

#Tableau Cloud

DIEGO FERNANDO MARTINEZ RODRIGUEZ · Accepted Answer

@Suryavamshi Sirigadhi https://trailblazers.salesforce.com/profileView?u=005KX000004JwY2YAK   Well it seems your workbook was published using REST API or the upload function. Then, I suggest you to:    a. Change the server name in the workbook connections in Tableau Cloud.  b. Download Tableau Desktop (it could be in  your machine)  b. Open Tableau Desktop and Sign in into Tableau Cloud (Server Menu -> Sign in)  c. Then Open the workbook (server menu -> Open Workbook)  d. Save the workbook  e. Publish with a different name, don't embed credentials  f. In Tableau Cloud, go to the workbook, and then to the datasources tab, edit the connection and add the credentials.  g. Try refreshing the workbook datasources in Tableau Cloud.    Note that the steps involving Tableau Desktop did not need any refresh step, just download, save, and publish without embedding credentials.    If this post resolves the question, would you be so kind to "Accept this Answer"?. This will help other users find the same answer/resolution and help community keep track of answered questions. Thank you.    Regards,    Diego Martinez  Tableau Visionary and Tableau Ambassador

Suryavamshi Sirigadhi · Answer

@DIEGO FERNANDO MARTINEZ RODRIGUEZ   Hi Diego, thanks a lot — your approach worked.    The part that unlocked it was realising Tableau Desktop never actually connects to the database during that process. We'd assumed it would need network access into the private VPC, which our machines don't have, and that assumption had us about to provision a Windows VM inside the VPC. I'd never have thought of it that way.    We also found the same thing works from the Cloud UI — Publish As with credentials unembedded, then adding them in the Data Sources tab afterwards. So the key step seems to be not embedding credentials at publish time, rather than using Desktop specifically.    Two follow-ups if you have a view on them.    1. Web authoring publish. When we edit a published workbook in the browser, the only option is "Publish As" — there's no plain Publish or Save, and File > Publish is greyed out. I'm a Site Administrator Creator and it behaves the same way on every workbook on the site, so it doesn't look like permissions or ownership. The workbooks were all published with "Show sheets as tabs" turned off, which I suspect is the cause. Is that right, and is there any way to get in-place publishing working short of turning tabs back on?    2. Custom views. We have 10+ dashboards to migrate with a lot of business-built custom views on them, and I've tested two routes:       - Publishing into a different project with identical workbook and sheet names — custom views didn't carry across.     - Republishing over an existing workbook in the same project from Desktop, sheet names unchanged — the custom views on it were wiped.    Does that match what you'd expect, or is there a publish configuration that preserves them that I'm missing? And have you used the Download / Publish Custom View REST endpoints for this in practice — reliable enough to lean on as a backup-and-restore step around a republish, or are there gotchas with shared vs private views and owner mapping?    One related thing: republishing from Desktop prompts for the database password embedded in the workbook, which we don't always hold when someone else published it originally. Is there a way to republish a workbook while leaving the existing embedded credentials on the server untouched?    Marking this as the accepted answer. Thanks again!

Bridge + private VPC Redshift — scheduled extract refresh fails for embedded data sources published via web UI. Is Desktop inside the VPC the only option?

Tableau Cloud

Aprendizaje relacionado

Más ayuda