## Firewall & IP allowlisting

URL: https://docs.atlan.com/apps/connectors/data-warehouses/amazon-redshift/how-tos/firewall-and-ip-allowlisting

> Allow Atlan's fixed source IPs through your security group so crawlers and miners can connect to publicly accessible Amazon Redshift clusters and workgroups.

For publicly accessible clusters and workgroups: permit Atlan's fixed source IPs through your security group so crawlers and miners can connect on port 5439.

## Do I need this?

- **Yes**, if you connect over the public path - every Redshift cluster sits behind a **security group**, and its default inbound rules won't include Atlan.
- **No**, if you use the [private network link](https://docs.atlan.com/llms/connectors/amazon-redshift/set-up-a-private-network-link-to-amazon-redshift/llms.txt) - traffic arrives through the managed endpoint, not from Atlan's public IPs.
- **Also check**: the cluster's **Publicly accessible** setting must be *on* for the public path to work at all. A security-group rule can't help a cluster that has no public address.

## Steps

1. *Atlan User* - Get your tenant's **public egress (NAT) IPs**: raise a support ticket with your tenant URL (values are tenant-specific - see [Atlan Network Details](https://docs.atlan.com/llms/governance/administration/atlan-network-details/llms.txt)).
2. *AWS / Redshift admin* - In the AWS console, open the cluster (or Serverless workgroup) and find its **VPC security group** under Properties → Network and security settings.
3. Add an **inbound rule** per Atlan IP: Type *Redshift*, Protocol *TCP*, Port `5439` (or your custom port), Source `<atlan-ip>/32`.
4. Check nothing else blocks the path: network ACLs on the subnet, or a corporate firewall in front of AWS.

```

# Security group inbound rules - one per Atlan egress IP (illustrative IPs)

Type: Redshift Protocol: TCP Port: 5439 Source: 203.0.113.10/32 # Atlan egress 1
Type: Redshift Protocol: TCP Port: 5439 Source: 203.0.113.11/32 # Atlan egress 2
```

:::caution Allowlist every IP support sends

Your tenant may egress from more than one IP. Allowlisting only the first one causes **intermittent** failures - workflows pass some hours and time out others, depending on which IP the traffic leaves from. Add them all.

:::

## SSL / TLS

Atlan supports connecting to Redshift over SSL, including clusters that enforce it with the `require_SSL` parameter - no extra crawler configuration is needed.

## Verify it worked

Run **Test connection** in the crawler setup. A timeout after ~30 seconds almost always means the security group (or the Publicly accessible setting) - an *authentication* error means the network path is fine; check [credentials](https://docs.atlan.com/llms/connectors/amazon-redshift/set-up-access-and-authentication/llms.txt) instead. That distinction is the fastest triage you can do; see [Troubleshooting Amazon Redshift connectivity](https://docs.atlan.com/llms/connectors/amazon-redshift/troubleshooting-amazon-redshift-connectivity/llms.txt).

## Next steps

[Set up access and authentication](https://docs.atlan.com/llms/connectors/amazon-redshift/set-up-access-and-authentication/llms.txt): Create the database user and configure authentication so Atlan can connect to your cluster.

---