Power BI Service refresh fails via VNet Data Gateway to AWS RDS SQL Server - EncryptedConnectionFail

Hi everyone,

I am trying to refresh a semantic model in Power BI Service by connecting to AWS RDS for SQL Server through a VNet Data Gateway.
However, the refresh keeps failing with an encrypted connection error.

Environment

• Power BI Service region: Southeast Asia
• Cluster URI shown in the error: WABI-SOUTH-EAST-ASIA-C-PRIMARY-redirect.analysis.windows.net
• Gateway type: VNet Data Gateway
• Data source: AWS RDS for SQL Server
• AWS region: ap-northeast-1
• Connector: SQL Server database connector
• Authentication: Basic / SQL Server authentication
• Connection path format: masked-rds-endpoint.ap-northeast-1.rds.amazonaws.com;masked-database-name
• ExpressRoute is already configured between Azure and the network where the RDS instance exists
• Connectivity from a test Azure VM to the target RDS SQL Server has already been verified

Questions

1. Does the CA certificate setting in the advanced settings of the VNet Data Gateway also apply to TLS certificate validation for the SQL Server connector?
2. When using encrypted connection with the SQL Server connector, how can I make Power BI Service / Fabric Dataflow Gen2 trust the AWS RDS SQL Server certificate through a VNet Data Gateway?
3. Has anyone successfully connected Power BI Service or Fabric Dataflow Gen2 to AWS RDS for SQL Server through a VNet Data Gateway with encrypted connection enabled?
4. From the Azure test VM, I can connect to the target RDS SQL Server through ExpressRoute. However, when connecting through the VNet Data Gateway, the refresh fails with EncryptedConnectionFailed. In this case, should I suspect a limitation or behavior difference in VNet Data Gateway certificate handling or SQL Server connector encryption settings?
5. If this is related to certificate handling limitations in VNet Data Gateway, would the recommended workaround be to install an On-premises data gateway on an Azure VM, import the AWS RDS CA certificate into the Windows certificate store, and connect Power BI through that gateway instead?

Network connectivity test

From a test Azure VM, I confirmed that I can connect to the target AWS RDS SQL Server.

I connected to SQL Server using SSMS and checked the connection with CONNECTIONPROPERTY. The result was similar to the following:

net_transport: TCP
protocol_type: TSQL
auth_scheme: SQL
sql_server_ip: 10.x.x.x
sql_server_port: 1433
client_ip: 10.x.x.x

Based on this, basic connectivity from the Azure test VM to the RDS SQL Server on TCP 1433 appears to be working, and SQL Server is reachable via a private IP.

Error message

The semantic model refresh fails with the following error:

Data source error:
DM_GWPipeline_Gateway_InvalidConnectionCredentials

UnderlyingErrorMessage:
The SQL source doesn't support encrypted connections.
Source: masked-rds-endpoint.ap-northeast-1.rds.amazonaws.com;masked-database-name

CredentialError.Reason:
EncryptedConnectionFailed

DataSourceKind:
SQL

DataSourcePath:
masked-rds-endpoint.ap-northeast-1.rds.amazonaws.com;masked-database-name

Although the top-level error code is InvalidConnectionCredentials, the underlying reason appears to be EncryptedConnectionFailed.

Therefore, I suspect this is not simply a username/password issue, but rather a TLS, certificate, or encrypted connection issue.

What I have already tried

1. Recreated the SQL Server data source connection in Power BI Service.
2. Reassigned the semantic model to the newly created VNet Data Gateway connection.
3. Uploaded the AWS RDS CA certificate to the advanced settings of the VNet Data Gateway.
   In the gateway settings screen, the certificate appears as:

CN = Amazon RDS ap-northeast-1 Root CA RSA4096 G1

1. From the Azure test VM, I confirmed that I can connect to the target RDS SQL Server using SSMS.
   The SQL Server is recognized through a private IP and is reachable on TCP 1433.
2. I tried to check the encryption status using sys.dm_exec_connections.encrypt_option, but the login I am using does not have VIEW SERVER STATE permission, so I could not confirm the encryption status from SQL Server.
3. I also tried connecting from Microsoft Fabric Dataflow Gen2 using the same SQL Server database connector and the same VNet Data Gateway.
   When “Use encrypted connection” is checked, the UI shows a credentials-related error, even though the credentials are expected to be correct.

Any advice on the correct configuration or experience with a similar issue would be greatly appreciated.