Connecting Amazon RDS MySQL to Power BI is a common requirement for organizations that want to unlock insights from their cloud databases. But depending on how your RDS is secured, the connection path can vary and not all approaches are equally safe or scalable.
In this guide, we’ll walk through six different ways to connect RDS to Power BI, highlight the most secure solution recommended by Microsoft, and explain when the simpler alternatives might make sense. By the end, you’ll have a clear view of the trade offs and be able to choose the right path for your business.
1. On premises Data Gateway (Most Secure, Recommended by Microsoft)
The On premises Data Gateway is Microsoft’s official solution for connecting Power BI Service to private or VPC restricted databases. It acts as a secure bridge between your cloud dashboards and your RDS instance.
How it works:
- Install the gateway on an EC2 instance or VM that can reach RDS.
- Register it with Power BI Service.
- Configure a MySQL data source inside the gateway.
- Power BI Service queries flow securely through the gateway.
Why it’s secure:
- RDS remains private, no public exposure.
- Access is controlled by AWS security groups and IAM.
- Gateway uses encrypted channels to Power BI Service.
- Analysts authenticate via Power BI, not directly to RDS.
This is the enterprise grade solution: secure, scalable, and compliant. If you want to align with best practices, this is the path to choose.
2: Expose RDS Directly
The simplest path is to open RDS to the internet by adjusting its security group.
How it works:
- Attach a security group to RDS that allows inbound MySQL (3306) from trusted IPs.
- Connect Power BI directly to the RDS endpoint.
Pros:
- Quick to set up.
- No gateway installation required.
Cons:
- RDS is publicly reachable.
- Must carefully restrict inbound IPs (office IPs or Power BI Service IP ranges).
- Higher risk if misconfigured.
Suitable for small teams or non sensitive datasets, but not recommended for production environments with strict compliance needs.
3: SSH Tunnel via EC2
This is the classic workaround when RDS is only accessible through EC2.
How it works:
- Create an SSH tunnel from your local machine to EC2, forwarding traffic to RDS.
- Connect Power BI Desktop to localhost:3307.
Pros:
- No changes to RDS security groups.
- Analysts can connect securely via EC2.
Cons:
- Works only for Power BI Desktop, not Power BI Service.
- Requires tunnel setup on each analyst’s machine.
- Not scalable for teams.
Best for quick testing or individual analysts, but not a long term solution.
4: Private Endpoint / VNet Peering
For hybrid cloud setups, you can use AWS PrivateLink or Azure VNet Peering to connect Power BI Service to RDS over a private network path.
How it works:
- Configure PrivateLink or VNet peering between your AWS VPC and Azure VNet.
- Power BI Service reaches RDS without public exposure.
Pros:
- Enterprise grade networking.
- Traffic stays within private networks.
- Very secure, compliant with strict regulations.
Cons:
- Complex to configure.
- Requires coordination between AWS and Azure networking teams.
Ideal for enterprises with hybrid cloud strategies and compliance requirements.
5: API Layer / Data Service
Instead of connecting Power BI directly to RDS, you can expose a secure API layer.
How it works:
- Build an API using AWS API Gateway + Lambda or a microservice.
- Power BI connects to the API, which queries RDS and returns only the needed data.
Pros:
- Fine grained control over queries.
- Easier to enforce caching, throttling, and auditing.
- RDS credentials are never exposed to analysts.
Cons:
- Adds development overhead.
- Requires ongoing maintenance of the API layer.
Great for compliance focused teams that want to abstract direct DB access.
6: Data Warehouse Integration
For scale and performance, sync RDS data into a warehouse like Amazon Redshift, Snowflake, or Azure Synapse.
How it works:
- ETL pipelines move data from RDS into the warehouse.
- Power BI connects natively to the warehouse.
Pros:
- Optimized for analytics workloads.
- Decouples reporting from transactional DB.
- Scales better for large datasets.
Cons:
- Adds cost and complexity.
- Requires ETL pipelines and data modeling.
Best for organizations with large datasets and advanced BI needs.
Choosing the Right Path
- Enterprise / Compliance focused: Use On premises Data Gateway (most secure).
- Small team / Quick setup: Expose RDS directly, but restrict IPs tightly.
- Individual analyst / Desktop only: Use SSH tunnel via EC2.
- Hybrid cloud / Networking teams: Private Endpoint / VNet Peering.
- Compliance / Abstraction needs: API Layer.
- Scale / Performance needs: Data Warehouse Integration.
Final Thoughts
Choosing the right way to connect Amazon RDS MySQL to Power BI depends on your priorities: security, simplicity, scalability, or compliance. While exposing RDS directly or using SSH tunnels may work in limited scenarios, the On premises Data Gateway remains the most secure and future proof option. It keeps your RDS private, leverages Microsoft’s secure architecture, and scales with your organization’s needs.
For advanced teams, PrivateLink/VNet Peering, API layers, or data warehouse integration can provide even greater control, compliance, and performance. Each path has its place, the key is to choose intentionally, based on your business goals and regulatory requirements.
