Securing Quick access from corporate networks with AWS PrivateLink | Amazon Web Services

Artificial Intelligence Securing Quick access from corporate networks with AWS PrivateLink When enterprise data sits behind a corporate firewall or in a private on-premises data center, there’s no direct network path from AWS, even though the AI agents and dashboards in Amazon Quick can query virtually any data source Administrators must make sure their sensitive enterprise data isn’t exposed to the public internet while being accessible for AI-driven insights and actions For many enterprises, routing traffic over the public internet introduces unacceptable risk

Details

Regulatory frameworks such as HIPAA, FedRAMP, and PCI-DSS often mandate that sensitive data remain within controlled network boundaries Even where compliance isn’t the primary driver, exposing internal data paths increases the attack surface, complicates audit trails and introduces variable latency that can degrade the user experience This walkthrough shows you how to connect on-premises data sources to Amazon Quick privately, without traffic traversing the public internet

Context

It assumes you already have AWS Direct Connect or an AWS Site-to-Site VPN linking your on-premises environment to your virtual private cloud VPC From that foundation, we configure VPC endpoints powered by AWS PrivateLink so that Quick can reach your private resources over the AWS backbone, then layer security groups and VPC endpoint policies for defense in depth

Impact

By the end, you will have a network architecture that keeps traffic between Quick and your on-premises data sources off the public internet, reducing the attack surface, providing consistent low-latency connectivity, and giving you a clear audit trail for compliance Amazon Quick and establishing private network connectivity Amazon Quick is an AI-powered workspace that brings search, analytics, research, and automation into a single conversational experience

What's Next

Understanding which components reach your private network, and how, determines the architecture in the sections that follow Data access in Amazon Quick falls into two paths User-facing traffic covers anyone opening the Quick console, interacting with a dashboard, making an API call, or using Quick Desktop All this routes through VPC endpoints see VPC endpoints for user and API access, keeping user sessions off the public internet

Background

Data-fetching traffic is when Quick itself reaches into your network to pull data This is handled by VPC connections see VPC connections for data source access, and it’s where most of the architectural decisions lie The features and integrations that initiate data-fetching connections are: Amazon Quick Sight queries on-premises databases PostgreSQL, MySQL, SQL Server, Oracle, and others directly through ENIs placed in your VPC

Analysis

This is the heaviest consumer of VPC connections Amazon Quick Flows and Amazon Quick Automate are separate automation features Automate handles complex, multi-system orchestration with human-in-the-loop Both invoke action connectors, including MCP servers hosted privately in your VPC Any workflow that calls an internal API routes through this path Quick Agents underpin all conversational interactions and can invoke action connectors directly

More

When a custom agent calls a privately hosted MCP server or internal API, traffic flows through the VPC connection Amazon Quick Index builds a unified search layer across connected sources such as Confluence, SharePoint, and Amazon Simple Storage Service Amazon S3 For data inside your VPC or on premises, knowledge base VPC connections are currently supported only for Amazon Redshift