Amazon Redshift will no longer support the creation of new Python UDFs starting Patch 198. Existing Python UDFs will continue to function until June 30, 2026. For more information, see the blog post .

Connect to Redshift with Identity-enhanced IAM role sessions

You can use IAM Identity Center to provide federated access to your Amazon Redshift clusters and serverless workgroups. This approach allows users to authenticate using their Identity Center credentials.

Amazon Redshift provides GetIdentityCenterAuthToken API operations to generate authorized token that contains user identity information. These APIs are available for both provisioned clusters and serverless workgroups. The tokens enable seamless single sign-on access to Amazon Redshift databases using your existing Identity Center setup.

Prerequisites

Before using Identity Center authentication with Amazon Redshift, ensure you have the following:

How Identity Center authentication works

Identity Center authentication for Amazon Redshift uses the following workflow:

GetIdentityCenterAuthToken API operations

Amazon Redshift provides two separate GetIdentityCenterAuthToken API operations: one for provisioned clusters and one for serverless workgroups. Both operations have the same name but accept different parameters depending on the target resource type.

GetIdentityCenterAuthToken for provisioned clusters

For provisioned Amazon Redshift clusters, use the GetIdentityCenterAuthToken API in the Amazon Redshift service to generate authorized token.

Request syntax

{
   "ClusterIds": [ "string" ]
}
                

Request parameters

CLI examples

Example: Get authorized token for a single cluster

aws redshift get-identity-center-auth-token \
    --cluster-ids my-redshift-cluster

Example: Get authorized token for multiple clusters

aws redshift get-identity-center-auth-token \
    --cluster-ids my-cluster-1 my-cluster-2

GetIdentityCenterAuthToken for serverless workgroups

For Amazon Redshift Serverless workgroups, use the GetIdentityCenterAuthToken API in the Amazon Redshift Serverless service to generate authorized token.

Request syntax

{
   "WorkgroupNames": [ "string" ]
}
                

Request parameters

CLI examples

Example: Get authorized token for a single workgroup

aws redshift-serverless get-identity-center-auth-token \
    --workgroup-names my-workgroup

Example: Get authorized token for multiple workgroups

aws redshift-serverless get-identity-center-auth-token \
    --workgroup-names workgroup-1 workgroup-2

Response syntax

Both APIs return the same response structure:

{
   "AuthorizedToken": "string",
   "ExpirationTime": "timestamp"
}
            

Response parameters

Example response

{
    "AuthorizedToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyQGV4YW1wbGUuY29tIiwiaWF0IjoxNjQwOTk1MjAwLCJleHAiOjE2NDA5OTg4MDAsImNsdXN0ZXJzIjpbIm15LWNsdXN0ZXIiXX0...",
    "ExpirationTime": "2024-01-01T12:00:00Z"
}

Driver integration

Amazon Redshift drivers support Identity Center authentication through direct token usage:

Direct token usage

After calling the GetIdentityCenterAuthToken API to obtain a token, use the IdpTokenAuthPlugin with the SUBJECT_TOKEN token type.

Connection Configuration:

plugin_name = com.amazon.redshift.plugin.IdpTokenAuthPlugin
token_type = SUBJECT_TOKEN
token = {encrypted_token_from_api_response}
            

For detailed information about Identity Center authentication plugins and driver configuration, see Connecting to an Amazon Redshift cluster.

Java code example

Sample Java code to connect using Identity Center authentication:

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;
import java.util.Properties;

// Get token from GetIdentityCenterAuthToken API
String token = "your_encrypted_token_from_api_response";

// Configure connection properties
Properties props = new Properties();
props.setProperty("user", "your_username");
props.setProperty("plugin_name", "com.amazon.redshift.plugin.IdpTokenAuthPlugin");
props.setProperty("token_type", "SUBJECT_TOKEN");
props.setProperty("token", token);

// Connect to Redshift
String url = "jdbc:redshift://your-cluster.region.redshift.amazonaws.com:5439/your_database";
try (Connection conn = DriverManager.getConnection(url, props)) {
    // Use connection
    System.out.println("Connected successfully!");
} catch (SQLException e) {
    e.printStackTrace();
}
            

IAM policy requirements

To use Identity Center authentication with Amazon Redshift, specific IAM permissions are required beyond the standard permissions needed for connecting to Amazon Redshift clusters and workgroups.

API permissions

For provisioned clusters, your enhanced IAM role session must have:

For serverless workgroups, your enhanced IAM role session must have:

Example IAM policies

Example policy for provisioned clusters:

{
    "Version": "2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "redshift:GetIdentityCenterAuthToken"
            ],
            "Resource": [
                "arn:aws:redshift:us-east-1:123456789012:cluster:my-cluster"
            ]
        }
    ]
}

Example policy for serverless workgroups:

{
    "Version": "2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "redshift-serverless:GetIdentityCenterAuthToken"
            ],
            "Resource": [
                "arn:aws:redshift-serverless:us-east-1:123456789012:workgroup/my-workgroup"
            ]
        }
    ]
}

Example policy for multiple resources:

{
    "Version": "2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "redshift:GetIdentityCenterAuthToken"
            ],
            "Resource": [
                "arn:aws:redshift:*:123456789012:cluster/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "redshift-serverless:GetIdentityCenterAuthToken"
            ],
            "Resource": [
                "arn:aws:redshift-serverless:*:123456789012:workgroup/*"
            ]
        }
    ]
}

Regional availability

Identity Center authentication is available in the following AWS regions: