About private connectivity
The private connection feature is available on the following dbt Enterprise tiers:
- Business Critical
- Virtual Private
To learn more about these tiers, contact us at sales@getdbt.com.
Private connections enables secure communication from any dbt environment to your data platform hosted on a cloud provider, such as AWS or Azure, using that provider’s private connection technology. Private connections allow dbt customers to meet security and compliance controls as it allows connectivity between dbt and your data platform without traversing the public internet. This feature is supported in most regions across North America, Europe, and Asia, but contact us if you have questions about availability.
Private connection endpoints can't connect across cloud providers (AWS, Azure, and GCP). For a private connection to work, both dbt and the server (like a data platform) must be hosted on the same cloud provider. For example, dbt hosted on AWS cannot connect to services hosted on Azure, and dbt hosted on Azure can’t connect to services hosted on GCP.
The following charts outline private connectivity options across dbt multi-tenant (MT) and single-tenant (ST) deployments.
Scope of this matrix
This matrix focuses on one question: can a private endpoint be established between dbt Cloud and the service at the network layer? Availability (✅) means dbt Cloud supports creating a private endpoint to that service using the cloud platform's private connectivity technology (AWS PrivateLink, Azure Private Link, or GCP Private Service Connect).
Beyond the network layer, the possibilities for application-layer configurations, authentication methods, and custom architectures are extensive. Not every combination has been tested. This matrix does not account for:
- Application-layer configurations or feature-specific requirements
- Custom architectures unique to your environment
- Service-specific limitations that may affect functionality after the private endpoint is established
For detailed setup instructions, refer to the individual configuration guides. If you have a custom configuration and are unsure whether it's supported, contact dbt Support.
Legend:
- ✅ = Available
- ❌ = Not currently available
- ST = Single-Tenant only
- - = Not applicable
Terminology
Parties and roles
| Loading table... |
Provisioning models
| Loading table... |
Endpoint types
| Loading table... |
Connecting dbt Cloud to your services
dbt Cloud can establish private connections to your services. The table below shows all supported services with their provisioning model and endpoint type.
| Loading table... |
Customer-provisioned connections
For customer-provisioned connectivity, you create and manage the private connectivity infrastructure and share access with dbt. This model supports any service that can be placed behind a load balancer and exposed via the cloud platform's private connectivity technology. All customer-provisioned connections use dedicated endpoints.
Prerequisites:
Your service must be exposed via the cloud platform's private connectivity technology:
| Loading table... |
*Other GCP load balancer types may be compatible, but Internal Proxy Load Balancer is the only type tested by dbt.
You must be able to grant dbt access to your endpoint.
Setup guides:
- AWS PrivateLink for self-hosted services
- Azure Private Link for self-hosted services
- GCP Private Service Connect for self-hosted services
If you have questions about whether your configuration is supported, contact dbt Support.
Connecting to dbt Cloud
Your services can connect to dbt Cloud over private connectivity. This is available on Single-Tenant deployments only.
| Loading table... |
Cross-region private connections
dbt Labs has globally connected private networks specifically used to host private endpoints, which are connected to dbt instance environments. This connectivity allows for dbt environments to connect to any supported region from any dbt instance within the same cloud provider network. To ensure security, access to these endpoints is protected by security groups, network policies, and application connection safeguards, in addition to the authentication and authorization mechanisms provided by each of the connected platforms.
Configuring private connections
dbt supports the following data platforms for use with the private connections feature. Instructions for enabling private connections for the various data platform providers are unique. The following guides will walk you through the necessary steps, including working with dbt Support to complete the connection in the dbt private network and setting up the endpoint in dbt.
AWS
Azure
GCP
Using Environment variables when configuring private connection endpoints isn't supported in dbt. Instead, use Extended Attributes to dynamically change these values in your dbt environment.
Was this page helpful?
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
