Dashboards on a private database: SSH tunnel or VPC

Metabase can connect to private databases either through Metabase Cloud using an SSH tunnel to a bastion host or by running a self-hosted Metabase instance inside the same VPC as the database. The cloud approach requires allowing fixed regional Metabase Cloud IP addresses to access the bastion over SSH while limiting database access to the bastion, whereas self-hosting keeps database traffic entirely within the organization’s cloud network and is suited to policies that prohibit external inbound connections. The guidance covers configuring network and security-group rules, Docker-based deployments with a separate PostgreSQL or MySQL application database, and implementations on AWS, Google Cloud, and Azure, including Redshift Serverless and Cloud SQL private-IP scenarios. It recommends using a dedicated read-only database account with appropriate schema and metadata access for syncing and querying, while noting that write permissions may be needed for features such as CSV uploads. Amazon QuickSight is presented as an AWS-native alternative that uses VPC connections, while Metabase supports comparable private-network access across multiple cloud providers.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.