Creating temporary IAM credentials

To create an IAM role with permissions to call GetClusterCredentialsWithIAM

1. Using the IAM service, create a user or role. You can also use an existing user or role. For example, if you created an IAM role for identity provider access, you can attach the necessary IAM policies to that role.

2. Attach a permission policy with permission to call the redshift:GetClusterCredentialsWithIAM operation. The following policy sample shows options to allow the operation for specific cluster and database, any database in cluster, and any database in any cluster.

   {
       "Version": "2012-10-17", 		 	 	 
       "Statement": [
           {
               "Sid": "SpecificClusterAndDBName",
               "Effect": "Allow",
               "Action": "redshift:GetClusterCredentialsWithIAM",
               "Resource": [
                   "arn:aws:redshift:us-east-1:123456789012:dbname:testcluster/testdatabase"
               ]
           },
           {
               "Sid": "SpecificClusterAndAnyDBName",
               "Effect": "Allow",
               "Action": "redshift:GetClusterCredentialsWithIAM",
               "Resource": "arn:aws:redshift:us-east-1:123456789012:dbname:examplecluster/*",
           },
           {
               "Sid": "AnyClusterAnyDatabase",
               "Effect": "Allow",
               "Action": "redshift:GetClusterCredentialsWithIAM",
               "Resource": "*"
           }
       ]
   }

To create an IAM role with permissions to call GetClusterCredentials

1. Using the IAM service, create a user or role. You can also use an existing user or role. For example, if you created an IAM role for identity provider access, you can attach the necessary IAM policies to that role.

2. Attach a permission policy with permission to call the redshift:GetClusterCredentials operation. Depending on which optional parameters you specify, you can also allow or restrict additional actions and resources in your policy:

   • To permit your SQL client to retrieve cluster ID, AWS Region, and port, include permission to call the redshift:DescribeClusters operation with the Redshift cluster resource.

   • If you use the AutoCreate option, include permission to call redshift:CreateClusterUser with the dbuser resource. The following Amazon Resource Name (ARN) specifies the Amazon Redshift dbuser. Replace region, account-id, and cluster-name with the values for your AWS Region, account, and cluster. For dbuser-name, specify the user name to use to log in to the cluster database.

     arn:aws:redshift:region:account-id:dbuser:cluster-name/dbuser-name
                             

   • (Optional) Add an ARN that specifies the Amazon Redshift dbname resource in the following format. Replace region, account-id, and cluster-name with the values for your AWS Region, account, and cluster. For database-name, specify the name of a database that the user will log in to.

     arn:aws:redshift:region:account-id:dbname:cluster-name/database-name
                             

   • If you use the DbGroups option, include permission to call the redshift:JoinGroup operation with the Amazon Redshift dbgroup resource in the following format. Replace region, account-id, and cluster-name with the values for your AWS Region, account, and cluster. For dbgroup-name, specify the name of a user group that the user joins at login.

     arn:aws:redshift:region:account-id:dbgroup:cluster-name/dbgroup-name

To create a database user and database groups

1. Log in to your Amazon Redshift database and create a database user using CREATE USER or alter an existing user using ALTER USER.

2. Optionally, specify the PASSWORD DISABLE option to prevent the user from using a password. When a user's password is disabled, the user can log on only using temporary credentials. If the password is not disabled, the user can log on either with the password or using temporary credentials. You can't disable the password for a superuser.

   Users need programmatic access if they want to interact with AWS outside of the AWS Management Console. The way to grant programmatic access depends on the type of user that's accessing AWS.

   To grant users programmatic access, choose one of the following options.

   Which user needs programmatic access?	To	By
   IAM	(Recommended) Use console credentials as temporary credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs.	Following the instructions for the interface that you want to use. For the AWS CLI, see Login for AWS local development in the AWS Command Line Interface User Guide. For AWS SDKs, see Login for AWS local development in the AWS SDKs and Tools Reference Guide.
   Workforce identity (Users managed in IAM Identity Center)	Use temporary credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs.	Following the instructions for the interface that you want to use. For the AWS CLI, see Configuring the AWS CLI to use AWS IAM Identity Center in the AWS Command Line Interface User Guide. For AWS SDKs, tools, and AWS APIs, see IAM Identity Center authentication in the AWS SDKs and Tools Reference Guide.
   IAM	Use temporary credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs.	Following the instructions in Using temporary credentials with AWS resources in the IAM User Guide.
   IAM	(Not recommended) Use long-term credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs.	Following the instructions for the interface that you want to use. For the AWS CLI, see Authenticating using IAM user credentials in the AWS Command Line Interface User Guide. For AWS SDKs and tools, see Authenticate using long-term credentials in the AWS SDKs and Tools Reference Guide. For AWS APIs, see Managing access keys for IAM users in the IAM User Guide.

   The following example creates a user with password disabled.

   create user temp_creds_user password disable; 

   The following example disables the password for an existing user.

   alter user temp_creds_user password disable;

3. Create database user groups using CREATE GROUP.

4. Use the GRANT command to define access privileges for the groups.

To configure a JDBC connection to use IAM credentials

1. Download the latest Amazon Redshift JDBC driver from the Configuring a connection for JDBC driver version 2.x for Amazon Redshift page.

2. Create a JDBC URL with the IAM credentials options in one of the following formats. To use IAM authentication, add iam: to the Amazon Redshift JDBC URL following jdbc:redshift: as shown in the following example.

   jdbc:redshift:iam://

   Add cluster-name, region, and account-id. The JDBC driver uses your IAM account information and cluster name to retrieve the cluster ID and AWS Region. To do so, your user or role must have permission to call the redshift:DescribeClusters operation with the specified cluster. If your user or role doesn't have permission to call the redshift:DescribeClusters operation, include the cluster ID, AWS Region, and port as shown in the following example. The port number is optional.

   jdbc:redshift:iam://examplecluster.abc123xyz789.us-west-2.redshift.amazonaws.com:5439/dev

3. Add JDBC options to provide IAM credentials. You use different combinations of JDBC options to provide IAM credentials. For details, see JDBC and ODBC options for creating database user credentials.

   The following URL specifies AccessKeyID and SecretAccessKey for a user.

   jdbc:redshift:iam://examplecluster:us-west-2/dev?AccessKeyID=AKIAIOSFODNN7EXAMPLE&SecretAccessKey=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

   The following example specifies a named profile that contains the IAM credentials.

   jdbc:redshift:iam://examplecluster:us-west-2/dev?Profile=user2

4. Add JDBC options that the JDBC driver uses to call the GetClusterCredentials API operation. Don't include these options if you call the GetClusterCredentials API operation programmatically.

   The following example includes the JDBC GetClusterCredentials options.

   jdbc:redshift:iam://examplecluster:us-west-2/dev?plugin_name=com.amazon.redshift.plugin.AzureCredentialsProvider&UID=user&PWD=password&idp_tenant=my_tenant&client_secret=my_secret&client_id=my_id

To configure an ODBC connection to use IAM credentials

In the following procedure, you can find steps only to configure IAM authentication. For steps to use standard authentication, using a database user name and password, see Configuring a connection for ODBC driver version 2.x for Amazon Redshift.

1. Install and configure the latest Amazon Redshift OBDC driver for your operating system. For more information, see Configuring a connection for ODBC driver version 2.x for Amazon Redshift page.

   Important

   The Amazon Redshift ODBC driver must be version 1.3.6.1000 or later.

2. Follow the steps for your operating system to configure connection settings.

3. On Microsoft Windows operating systems, access the Amazon Redshift ODBC Driver DSN Setup window.

   1. Under Connection Settings, enter the following information:

      • Data Source Name

      • Server (optional)

      • Port (optional)

      • Database

      If your user or role has permission to call the redshift:DescribeClusters operation, only Data Source Name and Database are required. Amazon Redshift uses ClusterId and Region to get the server and port by calling the DescribeCluster operation.

      If your user or role doesn't have permission to call the redshift:DescribeClusters operation, specify Server and Port.

   2. Under Authentication, choose a value for Auth Type.

      For each authentication type, enter values as listed following:

      AWS Profile

      Enter the following information:

      • ClusterID

      • Region

      • Profile name

        Enter the name of a profile in an AWS config file that contains values for the ODBC connection options. For more information, see Using a configuration profile.

      (Optional) Provide details for options that the ODBC driver uses to call the GetClusterCredentials API operation:

      • DbUser

      • User AutoCreate

      • DbGroups

        For more information, see JDBC and ODBC options for creating database user credentials.

      IAM Credentials

      Enter the following information:

      • ClusterID

      • Region

      • AccessKeyID and SecretAccessKey

        The access key ID and secret access key for the IAM role or user configured for IAM database authentication.

      • SessionToken

        SessionToken is required for an IAM role with temporary credentials. For more information, see Temporary Security Credentials.

      Provide details for options that the ODBC driver uses to call the GetClusterCredentials API operation:

      • DbUser (required)

      • User AutoCreate (optional)

      • DbGroups (optional)

        For more information, see JDBC and ODBC options for creating database user credentials.

      Identity Provider: AD FS

      For Windows Integrated Authentication with AD FS, leave User and Password empty.

      Provide IdP details:

      • IdP Host

        The name of the corporate identity provider host. This name should not include any slashes ( / ).

      • IdP Port (optional)

        The port used by identity provider. The default is 443.

      • Preferred Role

        An Amazon Resource Name (ARN) for the IAM role from the multi-valued AttributeValue elements for the Role attribute in the SAML assertion. To find the appropriate value for the preferred role, work with your IdP administrator. For more information, see Step 2: Configure SAML assertions for your IdP.

      (Optional) Provide details for options that the ODBC driver uses to call the GetClusterCredentials API operation:

      • DbUser

      • User AutoCreate

      • DbGroups

      For more information, see JDBC and ODBC options for creating database user credentials.

      Identity Provider: PingFederate

      For User and Password, enter your IdP user name and password.

      Provide IdP details:

      • IdP Host

        The name of the corporate identity provider host. This name should not include any slashes ( / ).

      • IdP Port (optional)

        The port used by identity provider. The default is 443.

      • Preferred Role

        An Amazon Resource Name (ARN) for the IAM role from the multi-valued AttributeValue elements for the Role attribute in the SAML assertion. To find the appropriate value for the preferred role, work with your IdP administrator. For more information, see Step 2: Configure SAML assertions for your IdP.

      (Optional) Provide details for options that the ODBC driver uses to call the GetClusterCredentials API operation:

      • DbUser

      • User AutoCreate

      • DbGroups

      For more information, see JDBC and ODBC options for creating database user credentials.

      Identity Provider: Okta

      For User and Password, enter your IdP user name and password.

      Provide IdP details:

      • IdP Host

        The name of the corporate identity provider host. This name should not include any slashes ( / ).

      • IdP Port

        This value is not used by Okta.

      • Preferred Role

        An Amazon Resource Name (ARN) for the IAM role from the AttributeValue elements for the Role attribute in the SAML assertion. To find the appropriate value for the preferred role, work with your IdP administrator. For more information, see Step 2: Configure SAML assertions for your IdP.

      • Okta App ID

        An ID for an Okta application. The value for App ID follows "amazon_aws" in the Okta application embed link. Work with your IdP administrator to get this value.

      (Optional) Provide details for options that the ODBC driver uses to call the GetClusterCredentials API operation:

      • DbUser

      • User AutoCreate

      • DbGroups

      For more information, see JDBC and ODBC options for creating database user credentials.

      Identity Provider: Azure AD

      For User and Password, enter your IdP user name and password.

      For Cluster ID and Region, enter the cluster ID and AWS Region of your Amazon Redshift cluster.

      For Database, enter the database that you created for your Amazon Redshift cluster.

      Provide IdP details:

      • IdP Tenant

        The tenant used for Azure AD.

      • Azure Client Secret

        The client secret of the Amazon Redshift enterprise app in Azure.

      • Azure Client ID

        The client ID (application ID) of the Amazon Redshift enterprise app in Azure.

      (Optional) Provide details for options that the ODBC driver uses to call the GetClusterCredentials API operation:

      • DbUser

      • User AutoCreate

      • DbGroups

      For more information, see JDBC and ODBC options for creating database user credentials.