Skip to main content
This guide applies only to ClickHouse Cloud services on AWS. For self-hosted ClickHouse in your own AWS network, follow the AWS PrivateLink guide.
Omni can connect to your ClickHouse Cloud service on Amazon Web Services (AWS) via PrivateLink. In this configuration, Omni establishes an encrypted connection from our network to ClickHouse Cloud over a private network using a VPC endpoint.

​
Requirements

To follow the steps in this guide, you’ll need Organization Admin permissions in Omni, plus the following in ClickHouse Cloud:
  • A service deployed on AWS
  • Permissions that allow you to view the service’s PrivateLink settings and manage private endpoints for your organization

​
Regions

Your ClickHouse Cloud service doesn’t have to be in the same region as your Omni instance. However, PrivateLink isn’t available in ap-east-2 and mx-central-1 regions. These regions don’t support cross-region PrivateLink, and Omni has no AWS environment in either region.

​
Setup

2

Contact Omni support

Contact Omni support with the following information:
  • The VPC endpoint service name, for example com.amazonaws.vpce.eu-west-1.vpce-svc-XXXXXXXXXX
  • The private DNS hostname, for example abc123.eu-west-1.vpce.aws.clickhouse.cloud
  • The AWS region where your ClickHouse Cloud service is deployed
  • The port your service will be listening on, typically 8443
  • Technical contact details, in case of connection difficulties

​
What’s next?

We will need you to authorize Omni’s endpoint after we create it. The endpoint ID doesn’t exist until then, so there’s nothing to add to ClickHouse before you contact us.
  1. Omni creates the VPC endpoint and sends you the endpoint ID, which starts with vpce-.
  2. Register the endpoint ID for your ClickHouse Cloud organization.
  3. Add the registered endpoint to the private endpoint allowlist of each ClickHouse service Omni should reach. In the ClickHouse Cloud console, this is under the service’s Settings > Set up private endpoint.
  4. Omni finishes wiring up the connection and adds it to your Omni instance.
The endpoint must be added at both the organization level and the service level. Organization-level registration alone doesn’t grant access to any service, and adding it only at the service level isn’t sufficient. The connection fails until you complete both steps.
Once this is complete, the connection can be used like any other database connection. You’ll need to provide your ClickHouse authentication credentials when setting up the connection in Omni.

​
References