Connect a redshift datasource with an IAM based authentication

Q&A
, , ,
2

Hi. Thanks you for your question! :slight_smile: Many of our community Experts and folks from our team are on holiday right now. I asked “My Assistant” (universal chat) in Quick, and got this back. @Brett Could you review and validate the answer below on Monday after you return from holiday?

From “My Assistant”:

”Connecting to Redshift with IAM Authentication in Quick

Quick supports three authentication methods for connecting to Amazon Redshift data sources :

  1. Trusted identity propagation (via IAM Identity Center)

  2. Run-as IAM role

  3. Amazon Redshift database credentials (traditional username/password)

Trusted Identity Propagation (Recommended for IAM-based access)

This is the most secure IAM-based authentication method. With trusted identity propagation:

  • A user’s identity is passed to Amazon Redshift with single sign-on managed by IAM Identity Center

  • The end user is authenticated in Amazon Redshift when they access Quick assets

  • Fine-grained data permissions are applied in Amazon Redshift before data is presented

  • All data security rules are automatically applied to data consumers in Quick

Prerequisites:

  • Your Quick account must be integrated with IAM Identity Center

  • Your Amazon Redshift cluster must be integrated with IAM Identity Center

  • Both must be in the same AWS organization and configured with the same IAM Identity Center instance

Setup steps:

  1. Configure Amazon Redshift OAuth scopes in your Quick account using the AWS CLI

  2. Specify the IAM Identity Center application ARN of your Redshift cluster

  3. When creating a dataset, choose Amazon Redshift as the data source

  4. Select IAM Identity Center as the identity option

Run-as IAM Role

Alternatively, you can use a run-as IAM role for Redshift connections :

  • Create an IAM role with appropriate Redshift permissions

  • Attach the role ARN to your Redshift data source

  • The role can include redshift:GetClusterCredentialsWithIAM permission for passwordless authentication

  • This works for both public network and VPC connections

Important limitations:

  • Trusted identity propagation is not currently supported for: SPICE datasets, Custom SQL on data sources, Alerts, Email reports, Quick Q, CSV/Excel/PDF exports, and Anomaly detection

  • Trusted identity propagation only works with Direct Query datasets, not SPICE”