Set up access and authentication

||Connect docs via MCP

✦TL;DR

Create the database user Atlan connects to Amazon Redshift as, grant it read permissions, and choose one of the three authentication methods.

Create the database user Atlan connects as, grant it read permissions, and choose one of the three authentication methods. Four phases, each labeled with who performs it.

Prerequisites

• Superuser or admin access to your Amazon Redshift cluster to create users, groups, and roles
• For IAM user or IAM role authentication: access to create IAM policies and users or roles in your AWS account
• A connectivity method already selected—see Choose how Atlan connects to Amazon Redshift

First: Choose your authentication method

	Basic (username + password)	IAM user	IAM role
What Atlan stores	A database username and password	An AWS access key + secret key	A role ARN (+ external ID) - no long-lived secret
How it connects	Straight to the cluster on port 5439	Calls the AWS API first (GetClusterCredentials) for short-lived credentials, then connects	Assumes your role via the AWS API first, then connects
Extra AWS setup	None	IAM policy with redshift:GetClusterCredentials	Cross-account role with trust policy + external ID; Serverless also needs a role tag
Works with Serverless	Yes	Yes (use the Workgroup field for private workgroups)	Yes - username not required; tag the role RedshiftDbRoles: atlan_role
Pick it when	You want the simplest path	Your policy forbids database passwords	Your policy forbids long-lived credentials entirely

IAM auth = one more traffic path

IAM user and IAM role authentication call the AWS API before touching your cluster. That call has its own permissions and its own error messages. If a workflow fails with an AccessDenied mentioning redshift:GetClusterCredentials, the network is fine - an IAM permission is missing. See Troubleshooting Amazon Redshift connectivity.

Four phases at glance

Phase	What happens	Owner	Typical time
1. Create user	Create atlan_user (or atlan_role for Serverless) and grant read permissions	AWS / Redshift admin	20 minutes
2. IAM setup	Only for IAM auth: create the policy / role in AWS	Your cloud/network team	20 minutes
3. Network path	Allowlist Atlan's IPs, or complete the private link guide	AWS / Redshift admin + Atlan support	Minutes–days (see method comparison)
4. Connect & verify	Configure the crawler, test connection, run preflight + a small crawl	Atlan User	30 minutes

Phase 1 - Create database user and grant permissions

Owner: AWS / Redshift admin

Provisioned clusters - create a user and a group, then grant read access per schema:

CREATE USER atlan_user PASSWORD '<strong-password>';
CREATE GROUP atlan_users WITH USER atlan_user;

-- Repeat per schema you want cataloged:
GRANT USAGE ON SCHEMA <schema_name> TO GROUP atlan_users;

Serverless - permissions attach to a role instead of a user/group:

CREATE ROLE atlan_role;
GRANT USAGE ON SCHEMA <schema_name> TO ROLE atlan_role;

Planning to mine query history for lineage (provisioned only)? Also grant:

GRANT SELECT ON pg_catalog.svl_statementtext TO GROUP atlan_users;
GRANT SELECT ON pg_catalog.stl_connection_log TO GROUP atlan_users;
ALTER USER atlan_user SYSLOG ACCESS UNRESTRICTED;

For the complete permission reference - external schema (Glue/Spectrum) grants, permission verification, and the cloned-schema procedure for restricted environments - see Set up Amazon Redshift.

Not the Redshift admin yourself?

Copy-paste request for your admin: "Please create a read-only user for the data catalog per Atlan's setup page (link). It only ever reads metadata and query history—never table data, unless querying is later enabled."

Phase 2 - IAM setup (skip for Basic auth)

Owner: Your cloud/network team

IAM user: create an IAM user with programmatic access and attach a policy that permits redshift:GetClusterCredentials on your cluster and the atlan_user database user. Hand the access key + secret key to whoever configures the crawler.

IAM role: create a role Atlan can assume cross-account. Atlan support provides the trusted principal and an external ID for the trust policy. For Serverless, additionally tag the role:

Key:   RedshiftDbRoles
Value: atlan_role

For the complete IAM policy JSON documents (including the Serverless redshift-serverless:GetCredentials variant) and the role trust policy with external ID, see Set up Amazon Redshift.

The permission that's always forgotten

redshift:GetClusterCredentials must cover both the cluster resource and the dbuser resource (for example, arn:aws:redshift:<region>:<account>:dbuser:<cluster>/atlan_user). Scoping it to the cluster alone produces an AccessDenied that looks like a network problem but isn't.

Phase 3 - Open network path

Owner: AWS / Redshift admin + Atlan support

Complete whichever you chose on the comparison page: Firewall & IP allowlisting (public path) or the private network link guide.

Phase 4 - Connect and verify

Owner: Atlan User

1. In Atlan, open New workflow → Amazon Redshift Assets and choose Direct extraction.
2. Host Name: the cluster endpoint from the AWS console's Configuration section - or, on a private link, the hostname Atlan support sent you.
3. Port: shown next to the endpoint; usually 5439.
4. Deployment Type: Provisioned or Serverless - this changes which auth fields appear.
5. Fill in your auth method's fields and click Test connection.

Success checklist

• Test connection passes in the Atlan UI
• Preflight checks pass when you configure the crawler
• A crawl scoped to one small schema completes
• A full crawl (and miner run, if used) completes

All four green? You're done. If any step fails, see Troubleshooting Amazon Redshift connectivity.

Next steps

Set up Amazon Redshift: Grant the full set of database permissions for your deployment type and configure IAM authentication.