Skip to main content
Use an SSH tunnel when your database is in a private VPC and cannot be reached directly from Lightdash. Lightdash opens an SSH connection to a bastion (jump) host that you run in a public subnet of your VPC, and forwards database traffic through it. The path is Lightdash Cloud → your bastion host → private database. SSH tunnelling is available for the Postgres and Redshift warehouse types, under the Use SSH tunnel option on the connection form.

​
Setup

1. Run a bastion/jump host. Provision a small server (for example an EC2 instance) in a public subnet of the VPC that contains your database. The bastion needs:
  • A public IP or hostname reachable from the internet.
  • A user account for Lightdash to log in as (for example ec2-user or ubuntu).
  • Network access to the database on its port (Postgres is typically 5432, Redshift 5439) — usually a VPC security group rule that lets the bastion’s security group reach the database’s security group on that port.
2. Configure the SSH tunnel in Lightdash. In your project’s connection settings, enable Use SSH tunnel and fill in:
  • SSH Remote Host: the bastion’s public hostname or IP.
  • SSH Remote Port: the bastion’s SSH port, usually 22.
  • SSH Username: the Linux user Lightdash logs in as.
Lightdash generates a public SSH key for the connection. Copy it. 3. Authorize the key on the bastion. Append the public key to ~/.ssh/authorized_keys for the SSH user you configured above. Authentication is SSH public-key auth — no separate certificate is needed. 4. Point the database at its private hostname. Keep the Host field on the connection set to the private database endpoint (the one that resolves inside the VPC). Lightdash resolves and connects to it from the bastion, not from the public internet. 5. Allow Lightdash to reach the bastion. Add Lightdash’s static IP addresses to the bastion’s security group on the SSH port you configured.

​
Encryption between the bastion and the database

The SSH tunnel already encrypts traffic between Lightdash and the bastion. You can additionally enable SSL on the database connection to encrypt the bastion-to-database hop; SSH tunnels work with or without it.