Amazon Redshift Connection

This guide describes how to connect to Amazon Redshift.

Amazon Redshift is a fully managed, petabyte-scale data warehouse service in the AWS Cloud. For more information, see the official Amazon Redshift documentation.

You can authenticate using database credentials (username and password) or using AWS assumed role authentication (hybrid deployment only).

Prerequisites

For AWS assumed role authentication, make sure the following conditions are met:

A hybrid Data Processing Engine (DPE) is deployed on an Amazon EC2 instance. See VM-Based Hybrid DPE Deployment Guide.
The Amazon Redshift JDBC driver is enabled on the DPE.
An IAM role with access to Amazon Redshift is attached to the EC2 instance where the hybrid DPE runs. See Configure the IAM role.

Configure the IAM role

To connect using AWS assumed role authentication, the IAM role attached to the EC2 instance must meet the following requirements:

The role trust policy allows EC2 instances to assume the role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

The role has the permissions required to access your Redshift cluster and retrieve temporary database credentials, in particular redshift:GetClusterCredentials and redshift:DescribeClusters.

For more information about the required permissions and IAM policy examples, see Options for providing IAM credentials in the AWS documentation.

Create a source

To connect to Amazon Redshift:

Navigate to Data Catalog > Sources.
Select Create.
Provide the following:
- Name: The source name.
- Description: A description of the source.
- Deployment (Optional): Choose the deployment type.
  
  You can add new values if needed. See Lists of Values.
- Stewardship: The source owner and roles. For more information, see Stewardship.

Alternatively, add a connection to an existing data source. See Connect to a Source.

Add a connection

Select Add Connection.
In Connection type, choose Relational Database > Amazon Redshift.

Provide the following:

Name: A meaningful name for your connection. This is used to indicate the location of catalog items.
Description (Optional): A short description of the connection.
Dpe label (Optional): Assign the processing of a data source to a particular data processing engine (DPE) by entering the DPE label assigned to the engine. For more information, see DPM and DPE Configuration in DPM Admin Console.

If you are using AWS assumed role authentication, make sure the connection is processed by the hybrid DPE running on the EC2 instance with the IAM role attached.
Override catalog item name: Select this option if you want metadata imports to overwrite the names of existing catalog items with the latest names from the data source.

If the option is not selected, catalog item names you set in ONE are preserved when metadata is reimported. See Edit catalog item metadata.

JDBC: A JDBC connection string for your Redshift cluster.

The format of the connection string depends on the authentication method:

Username and password authentication:

jdbc:redshift://<redshift-endpoint>:5439/<database>

AWS assumed role authentication (integrated credentials):
```
jdbc:redshift:iam://<redshift-endpoint>:5439/<database>?DbUser=<db_user>
```
The iam keyword instructs the driver to authenticate using IAM. The DbUser parameter specifies the database user the temporary credentials are issued for.

For the full list of supported parameters, see Options for JDBC driver version 2.1 configuration in the AWS documentation.

In Additional settings, select Enable exporting and loading of data if you want to export data from this connection and use it in ONE Data or outside of ONE.

If you want to export data to this source, you also need to configure write credentials. See Connection credentials.

Consider the security and privacy risks of allowing the export of data to other locations.

Add credentials

Different sets of credentials can be used for different tasks. One set of credentials must be set as default for each connection.

To determine whether you need to configure more than a single set of credentials, see Connection credentials.

Select Add Credentials.
Choose an authentication method and proceed with the corresponding step:
- Username and password: Basic authentication using your database username and password.
- Integrated credentials: Use the IAM role attached to the EC2 instance where the hybrid DPE runs (AWS assumed role authentication).

Username and password

Select Username and password and provide the following:
- Name (Optional): A name for this set of credentials.
- Description (Optional): A description for this set of credentials.
- Username: The username for the data source.
- Password: The password for the data source.
  
  To use a secret management service to provide these values, see Secret management service credentials.
If you want to use this set of credentials by default when connecting to the data source, select Set as default.

See also Connection credentials.
Proceed with Test the connection.

Integrated credentials

Use this option to authenticate with the IAM role attached to the EC2 instance where the hybrid DPE runs. No additional values need to be provided in ONE; the JDBC connection string must use the jdbc:redshift:iam:// format. See Add a connection.

Select Integrated credentials and provide the following:
- Name (Optional): A name for this set of credentials.
- Description (Optional): A description for this set of credentials.
If you want to use this set of credentials by default when connecting to the data source, select Set as default.

See also Connection credentials.
Proceed with Test the connection.

Secret management service credentials

Select Username and password and provide the following:
- Name (Optional): A name for this set of credentials.
- Description (Optional): A description for this set of credentials.
- Select a secret management service: Specify which secret management service should be used to retrieve the credential values. For more information, see Secret Management Services.
- Username: Enable Use secret management service and provide the name the username is stored under in your selected secret management service.
- Password: Enable Use secret management service and provide the name the password is stored under in your selected secret management service.
If you want to use this set of credentials by default when connecting to the data source, select Set as default.

See also Connection credentials.
Proceed with Test the connection.

Test the connection

To test and verify whether the data source connection has been correctly configured, select Test Connection.

If the connection is successful, continue with the following step. Otherwise, verify that your configuration is correct and that the data source is running.

Save and publish

Once you have configured your connection, save and publish your changes. If you provided all the required information, the connection is now available for other users in the application.

In case your configuration is missing required fields, you can view a list of detected errors instead. Review your configuration and resolve the issues before continuing.

Next steps

You can now browse and profile assets from your connection.

In Data Catalog > Sources, find and open the source you just configured. Switch to the Connections tab and select Document. Alternatively, opt for Import or Discover documentation flow.

Or, to import or profile only some assets, select Browse on the Connections tab. Choose the assets you want to analyze and then the appropriate profiling option.

Was this page useful?