Set up access and authentication

✦TL;DR

Create the database user Atlan connects to Amazon Redshift as, grant it read permissions, and choose one of the three authentication methods.

||

Your AI can read this via Docs MCPcurl -fsSL "https://docs.atlan.com/install-docs-mcp" | bashConnect

Create the database user Atlan connects as, grant it read permissions, and choose one of the three authentication methods. Four phases, each labeled with who performs it.

Prerequisites

• Superuser or admin access to your Amazon Redshift cluster to create users, groups, and roles
• For IAM user or IAM role authentication: access to create IAM policies and users or roles in your AWS account
• A connectivity method already selected—see Choose how Atlan connects to Amazon Redshift

First: Choose your authentication method

	Basic (username + password)	IAM user	IAM role
What Atlan stores	A database username and password	An AWS access key + secret key	A role ARN (+ external ID) - no long-lived secret
How it connects	Straight to the cluster on port 5439	Calls the AWS API first (GetClusterCredentials) for short-lived credentials, then connects	Assumes your role via the AWS API first, then connects
Extra AWS setup	None	IAM policy with redshift:GetClusterCredentials	Cross-account role with trust policy + external ID; Serverless also needs a role tag
Works with Serverless	Yes	Yes (use the Workgroup field for private workgroups)	Yes - username not required; tag the role RedshiftDbRoles: atlan_role
Pick it when	You want the simplest path	Your policy forbids database passwords	Your policy forbids long-lived credentials entirely

IAM auth = one more traffic path

IAM user and IAM role authentication call the AWS API before touching your cluster. That call has its own permissions and its own error messages. If a workflow fails with an AccessDenied mentioning redshift:GetClusterCredentials, the network is fine - an IAM permission is missing. See Troubleshooting Amazon Redshift connectivity.

Four phases at glance

Phase	What happens	Owner	Typical time
1. Create user	Create atlan_user (or atlan_role for Serverless) and grant read permissions	AWS / Redshift admin	20 minutes
2. IAM setup	Only for IAM auth: create the policy / role in AWS	Your cloud/network team	20 minutes
3. Network path	Allowlist Atlan's IPs, or complete the private link guide	AWS / Redshift admin + Atlan support	Minutes–days (see method comparison)
4. Connect & verify	Configure the crawler, test connection, run preflight + a small crawl	Atlan User	30 minutes

Phase 1 - Create database user and grant permissions

Owner: AWS / Redshift admin

Provisioned clusters - create a user and a group, then grant read access per schema:

CREATE USER atlan_user PASSWORD '<strong-password>';
CREATE GROUP atlan_users WITH USER atlan_user;

-- Repeat per schema you want cataloged:
GRANT USAGE ON SCHEMA <schema_name> TO GROUP atlan_users;

Serverless - permissions attach to a role instead of a user/group:

CREATE ROLE atlan_role;
GRANT USAGE ON SCHEMA <schema_name> TO ROLE atlan_role;

Planning to mine query history for lineage (provisioned only)? Also grant:

GRANT SELECT ON pg_catalog.svl_statementtext TO GROUP atlan_users;
GRANT SELECT ON pg_catalog.stl_connection_log TO GROUP atlan_users;
ALTER USER atlan_user SYSLOG ACCESS UNRESTRICTED;

For the complete permission reference - external schema (Glue/Spectrum) grants, permission verification, and the cloned-schema procedure for restricted environments - see Set up Amazon Redshift.

Not the Redshift admin yourself?

Copy-paste request for your admin: "Please create a read-only user for the data catalog per Atlan's setup page (link). It only ever reads metadata and query history—never table data, unless querying is later enabled."

Phase 2 - IAM setup (skip for Basic auth)

Owner: Your cloud/network team

IAM user: create an IAM user with programmatic access and attach a policy that permits redshift:GetClusterCredentials on your cluster and the atlan_user database user. Hand the access key + secret key to whoever configures the crawler.

IAM role: create a role Atlan can assume cross-account. Atlan support provides the trusted principal and an external ID for the trust policy. For Serverless, additionally tag the role:

Key:   RedshiftDbRoles
Value: atlan_role

For the complete IAM policy JSON documents (including the Serverless redshift-serverless:GetCredentials variant) and the role trust policy with external ID, see Set up Amazon Redshift.

The permission that's always forgotten

redshift:GetClusterCredentials must cover both the cluster resource and the dbuser resource (for example, arn:aws:redshift:<region>:<account>:dbuser:<cluster>/atlan_user). Scoping it to the cluster alone produces an AccessDenied that looks like a network problem but isn't.

Phase 3 - Open network path

Owner: AWS / Redshift admin + Atlan support

Complete whichever you chose on the comparison page: Firewall & IP allowlisting (public path) or the private network link guide.

Phase 4 - Connect and verify

Owner: Atlan User

1. In Atlan, open New workflow → Amazon Redshift Assets and choose Direct extraction.
2. Host Name: the cluster endpoint from the AWS console's Configuration section - or, on a private link, the hostname Atlan support sent you.
3. Port: shown next to the endpoint; usually 5439.
4. Deployment Type: Provisioned or Serverless - this changes which auth fields appear.
5. Fill in your auth method's fields and click Test connection.

Success checklist

• Test connection passes in the Atlan UI
• Preflight checks pass when you configure the crawler
• A crawl scoped to one small schema completes
• A full crawl (and miner run, if used) completes

All four green? You're done. If any step fails, see Troubleshooting Amazon Redshift connectivity.

Next steps

Set up Amazon Redshift: Grant the full set of database permissions for your deployment type and configure IAM authentication.