How to secure scheduled refreshes in Power BI service from data source in AWS VPC?

[otravers]

With a couple of my clients we're looking at further securing how Power BI connects to databases in Amazon RDS. As a starting point we don't want the source database to be exposed to the public Internet. I'm trying to figure out the architectural options, but while I have a modicum of Azure and cloud networking knowledge, I'm not an expert in these areas, and my clients know the Amazon side better than the Microsoft side. But as their Power BI guy they turn to me for advice, and I don't know what I don't know here. Here's what I've found so far, any guidance would be much appreciated.

Exhibit A - solution architecture proposed by Amazon, with on-premises data gateway in a private subnet

The following page has an interesting architecture - they even run Power BI desktop in a cloud VM - and it does keep the source database private (in this case Redshift but it could be RDS). But my concern is that data going from the data gateway to the Power BI service flows through the public internet:

https://aws.amazon.com/blogs/big-data/integrate-power-bi-with-amazon-redshift-for-insights-and-analy...

Exhibit B - site to site VPN between AWS and Azure

The following pages discuss how to set up a dual-cloud VPN, which sounds promising:

- https://levelup.gitconnected.com/azure-to-aws-vpn-step-by-step-b8c853a62

- https://infra.engineer/azure/52-site-to-site-vpn-between-aws-and-azure

My concern with this is, how can you "inform" the data gateway and Power BI service to use this network? As far as I know networking settings in the data gateway are fairly limited: HTTPS vs. TCP, and an optional proxy server. I know that the data gateway uses Azure Service Bus behind the scenes, but it's not exposed to us end users, is it?

I've read about Azure service endpoints and private endpoints, but while that could be used if the database was Azure SQL, this does not seem relevant to an AWS data source.

Would handling dataflow and dataset refreshes via the Power BI REST APIs, say in Azure Functions, give more control over the underlying networking?

Any tips and pointers are appreciated. I think my main question is whether there's a way to avoid routing traffic from the data gateway to the Power BI service via the public internet. I know it's encrypted, but it would be great if there was a way to avoid it. And of course we don't want to make the whole thing more complicated than it needs to be.

[GilbertQ]

Hi there

I currently have a large customer who has got a VPC with the Gateway server running within the VPC.

We connect to the Power BI Service via HTTPS, which we have seen is more than secure to transport the data to the PBI Service. The only time the dataset will be seen will be in the browser. The rest of the time the data is fully encrypted.

This also is an architecture where it is secure and simple.

[otravers]

@GilbertQ thanks for your input. Your setup is similar to Amazon's architecture. Unless I hear otherwise, for now I will assume that communication from the data gateway to the Power BI service has to go through the public internet (still encrypted, obviously).

[GilbertQ]

Yeah you are 100% correct and that is how all the gateways connect to the PBI Service.

And in the 5 years since PBI has been running I have not read or heard of any issues with it running this way.

[otravers · Accepted solution]

After further research with help from @dataveld, there are two options:

1. Azure ExpressRoute - this was introduced in 2016 but weirdly the Power BI-specific integration documentation was (silently) retired a couple of years ago. You can still find it on Github, but that doesn't exactly inspire confidence.

2. Azure Private Link - this is already in GA for some Azure endspoints such as SQL and ADLS, but as of this writing the "public preview" announced for July 2020 in Power BI's roadmap translates to a header in the the Power BI admin settings followed by... nothing.

So it looks like Private Link will be the way to go once it's actually live for Power BI. In the meantime ExpressRoute is probably still an option, if poorly documented/supported.