Metabase vs Amazon Quick Sight (QuickSight) for Redshift and RDS

Metabase and Amazon Quick Sight (formerly Amazon QuickSight) both build dashboards on Amazon Redshift and Amazon RDS for PostgreSQL, including databases in a private VPC with no public endpoint. Quick Sight reaches a private VPC through a VPC connection, which is part of its Enterprise edition. Metabase reaches the same database when you run it inside your VPC on Amazon ECS or EC2, or from Metabase Cloud through an SSH tunnel. Metabase’s open-source edition is free, and guest embeds with locked parameters work on every edition, including the free one.

Amazon Quick Sight is the BI feature of Amazon Quick, which AWS launched as Amazon Quick Suite in October 2025. Existing QuickSight APIs and SDKs keep working under the new name. This page compares the two tools on private network access, pricing, embedded analytics, row-level security, email reports and self-service. Prices and plan details were checked on October 7, 2026.

How does each tool reach Redshift or RDS in a private VPC?

Quick Sight uses a VPC connection, which AWS documents as an Enterprise edition feature. Creating one adds elastic network interfaces in your VPC, and your route tables, network ACLs and security groups apply to that traffic. Redshift, RDS, Aurora and PostgreSQL are among the data sources that can use a VPC connection.

Metabase gives you two ways to reach the same private database.

Run Metabase inside your VPC. Metabase ships an official Docker image, so you can run it on Amazon ECS or on an EC2 instance in a private subnet next to Redshift or RDS. On ECS, a task in awsvpc network mode gets its own network interface, a private IP address and the security groups you choose. You allow inbound traffic from Metabase’s security group on the database port, and the database never needs a public endpoint. Metabase keeps its own questions and dashboards in an application database. Its docs recommend PostgreSQL on the same network as Metabase, such as an RDS for PostgreSQL instance in the same VPC. If you embed dashboards for customers, put Metabase behind a public load balancer while the database stays private.

Use Metabase Cloud. Metabase Cloud connects from fixed IP addresses that Metabase publishes for each region. To keep Redshift or RDS private, turn on the SSH tunnel option in the connection form and point it at a bastion host that accepts SSH only from those addresses. You can also make the database publicly accessible and allow the same addresses in its security group, but the tunnel keeps the database itself off the internet.

# Metabase on an EC2 instance inside the VPC, with its application data in RDS for PostgreSQL.
# Follows "Running Metabase on Docker" (production installation).
docker run -d -p 3000:3000 \
  -e "MB_DB_TYPE=postgres" \
  -e "MB_DB_DBNAME=metabaseappdb" \
  -e "MB_DB_PORT=5432" \
  -e "MB_DB_USER=metabase" \
  -e "MB_DB_PASS=your_password" \
  -e "MB_DB_HOST=metabase-app.abcdefghij12.us-east-1.rds.amazonaws.com" \
  --name metabase metabase/metabase:v0.64.1

# Let Metabase's security group reach Redshift on port 5439 (use 5432 for RDS for PostgreSQL).
# --group-id is the database's security group, --source-group is the one attached to Metabase.
aws ec2 authorize-security-group-ingress \
  --group-id sg-0123456789abcdef0 \
  --protocol tcp \
  --port 5439 \
  --source-group sg-0fedcba9876543210

# Metabase Cloud with an SSH tunnel: allow SSH to the bastion host only from Metabase Cloud.
# These are the us-east-1 addresses from "IP addresses to whitelist"; use your region's list.
for ip in 18.207.81.126 3.211.20.157 50.17.234.169; do
  aws ec2 authorize-security-group-ingress \
    --group-id sg-0a1b2c3d4e5f60718 \
    --protocol tcp \
    --port 22 \
    --cidr "$ip/32"
done

On ECS, put the same image and environment variables in the task definition, and point the health check at /api/health, as Metabase’s production guide suggests. For Redshift Serverless, the workgroup endpoint gives you the host, the default port 5439 and the database name that Metabase’s Redshift connection form asks for. A self-hosted Metabase Pro or Enterprise can connect to RDS for PostgreSQL, RDS for MySQL and Aurora with IAM authentication instead of a password. On EC2 or ECS, Metabase’s Amazon Athena connection can use the instance profile or the ECS task role instead of stored access keys.

Give Metabase its own read-only database user. On Redshift, run this as an admin:

-- Follows "Database users, roles, and privileges" and the Amazon Redshift GRANT docs.
CREATE USER metabase PASSWORD 'Replace-with-a-Str0ng-password';
GRANT USAGE ON SCHEMA analytics TO metabase;
GRANT SELECT ON ALL TABLES IN SCHEMA analytics TO metabase;

-- Optional, as a superuser: tables that dbt_user creates later in this schema are readable too.
ALTER DEFAULT PRIVILEGES FOR USER dbt_user IN SCHEMA analytics
  GRANT SELECT ON TABLES TO metabase;

QuickSight pricing for authors, readers and sessions, next to Metabase plans

Quick Sight prices by user role. An Author costs $24 per user per month and can connect to data, build dashboards and share them. A Reader costs $3 per user per month and can explore dashboards, receive email reports and download data. Author Pro costs $40 and Reader Pro costs $20, and they add generative AI features. A $250 monthly infrastructure fee applies to an account with at least one Pro user, or with Q&A turned on through topics or on dashboards.

For embedded or occasional readers, Quick Sight sells reader sessions instead of seats. The monthly plan includes 500 sessions for $250, each extra session costs $0.50, and a session is a 30-minute period. SPICE, the in-memory store for imported data, costs $0.38 per GB per month, and each Author comes with 10 GB.

Metabase prices by plan and by user, and making more dashboards, running more queries or connecting more data sources doesn’t change the price. The open-source edition is free to self-host, with unlimited users. Starter is a Metabase Cloud plan at $100 a month with 5 users included, then $6 per extra user per month. Pro costs $575 a month with 10 users included, then $12 per extra user per month, on Metabase Cloud or self-hosted. Enterprise starts at $20,000 a year.

Embedded analytics: QuickSight anonymous embedding vs Metabase guest embeds

To embed Quick Sight, the AWS account needs the Enterprise edition. For visitors who aren’t Quick Sight users, your backend calls GenerateEmbedUrlForAnonymousUser, which needs session capacity pricing on the account. Row-level security with session tags works only for this anonymous embedding: you add tag rules to the dataset and pass the tag values in SessionTags when you generate the URL. Users that you register in Quick Sight get their embeds through GenerateEmbedUrlForRegisteredUser.

Metabase guest embeds work on every edition, including the free open-source edition. Your server signs a JWT that names the dashboard and sets its locked parameters, such as the customer ID from your app’s session, and viewers don’t need Metabase accounts. A locked parameter is hidden from the viewer and only your server can set it, so your app keeps deciding which customer sees which rows. Every token must include every locked parameter, and Metabase refuses a token that leaves one out. On the open-source and Starter plans, guest embeds show a Powered by Metabase banner. SSO embeds with JWT or SAML, the modular embedding SDK for React, row and column security, and tenants are part of the Pro and Enterprise plans.

// server.js: npm install express jsonwebtoken
// Follows "Guest embeds" (locked parameters). In Metabase, set the dashboard's
// "customer_id" filter to Locked in the embed settings, then publish.
const express = require("express");
const jwt = require("jsonwebtoken");

const METABASE_URL = process.env.METABASE_URL; // for example https://metabase.example.com
const METABASE_SECRET_KEY = process.env.METABASE_SECRET_KEY; // your embedding secret key

const app = express();

app.get("/reports", (req, res) => {
  // req.user is set by your app's own auth middleware.
  const customerId = req.user.customerId;

  const token = jwt.sign(
    {
      resource: { dashboard: 10 },
      params: { customer_id: [String(customerId)] },
      exp: Math.round(Date.now() / 1000) + 10 * 60, // 10 minute expiration
    },
    METABASE_SECRET_KEY
  );

  res.send(`
    <script defer src="${METABASE_URL}/app/embed.js"></script>
    <script>
      window.metabaseConfig = { isGuest: true, instanceUrl: "${METABASE_URL}" };
    </script>
    <metabase-dashboard token="${token}" with-title="true"></metabase-dashboard>
  `);
});

app.listen(3001);

Row-level security for your own team

Inside Quick Sight, row-level security uses dataset rules keyed on user or group names, and it is an Enterprise edition feature. A user or group without a rule sees no rows.

Metabase’s row and column security filters a table for each group by user attributes, such as a region or a customer ID. It is part of the Pro and Enterprise plans. Pro and Enterprise also offer impersonation on Redshift and PostgreSQL, which runs each query under a database role, so your database’s own rules apply to SQL questions too. On Redshift, the connection user for impersonation must be a superuser, because Metabase runs SET SESSION AUTHORIZATION.

Scheduled email reports, Slack and SPICE refresh

Quick Sight emails dashboard reports on the Enterprise edition, once or on a daily, weekly, monthly or yearly schedule. Recipients must be part of your Quick subscription and have the dashboard shared with them, and each dashboard can have up to five schedules. A Quick Sight dataset either queries the database directly or imports data into SPICE, which refreshes on a schedule you set. The Enterprise edition can also refresh SQL sources such as Redshift incrementally.

Metabase sends dashboard subscriptions by email or Slack on every edition, hourly, daily, weekly or monthly. Email subscriptions can go to people who don’t have a Metabase account, and Pro and Enterprise let you set different filter values for each subscription. Metabase runs questions against Redshift or RDS itself, so there’s no copy of the data to refresh, and caching can store results that don’t change often. On a self-hosted open-source Metabase, email goes through your own SMTP server, and Metabase Cloud manages one for you.

Who can create dashboards and explore data?

In Quick Sight, Authors connect to data and build dashboards, and Readers explore the dashboards that Authors share. In Metabase, anyone you give query permissions can build questions in the query builder, which lets them pick data, join tables, filter, summarize and chart without writing SQL. Analysts can use the SQL editor, and both ways to build questions come with every edition. Metabase plans count users, so there’s no separate author price.

When is Amazon Quick Sight the natural fit?

Quick Sight is the natural fit when your company already uses Amazon Quick, or wants BI on the AWS bill with no BI server to run. It also suits a large group of people who only view dashboards, since a Reader costs $3 a month. And it suits teams that already import data into SPICE from Athena or Amazon S3.

Metabase fits when people across the company should explore data and build their own questions. It also fits when you embed dashboards for customers and want the tenant rule to stay in your app, with no session pricing. And it fits when you want BI that runs inside your own VPC or on any cloud, with Slack delivery and a free edition to start.

Next steps

• Connect Metabase to Amazon Redshift
• Connect Metabase to PostgreSQL and use IAM authentication with Amazon RDS
• Set up an SSH tunnel and find the Metabase Cloud IP addresses
• Run Metabase on Docker
• Create guest embeds with locked parameters
• Set up SSO for embeds and tenants
• Set up row and column security
• Send dashboard subscriptions
• Compare Metabase plans