Issue
How to securely connect a data warehouse like Amazon Redshift or Postgres to Twilio Segment without opening inbound firewall ports to the public internet, and how to control streaming event data to destinations like Salesforce and Intercom to prevent exceeding API limits.
Product
Twilio Segment
Environment
Segment Console
Cause
Corporate security guidelines often prohibit exposing internal database clusters or cloud networks to the public internet via open routing ports. Additionally, high-volume tracking setups risk overwhelming destination streaming processes or triggering strict API limits on third-party CRM and engagement tools like Salesforce or Intercom.
Resolution
Instead of creating inbound firewall rules for public traffic, utilize an AWS PrivateLink tunnel:
Reach out to your Segment Customer Success Manager (CSM) or Account Executive to express interest in establishing an AWS PrivateLink connection.
Segment will provide you with their AWS Edge account ID and VPC ID.
Log into your AWS Console and grant cluster access to the provided Segment environment details.
Provide your AWS Account ID and Redshift Cluster Identifier back to your Segment CSM.
Segment engineering will generate an internal, isolated PrivateLink Endpoint URL. Use this URL as the Hostname value in your destination setup.