## Set up access and authentication

URL: https://docs.atlan.com/apps/connectors/data-warehouses/amazon-redshift/how-tos/set-up-access-and-authentication

> Create the database user Atlan connects to Amazon Redshift as, grant it read permissions, and choose one of the three authentication methods.

Create the database user Atlan connects as, grant it read permissions, and choose one of the three authentication methods. Four phases, each labeled with who performs it.

## Prerequisites

- Superuser or admin access to your Amazon Redshift cluster to create users, groups, and roles
- For IAM user or IAM role authentication: access to create IAM policies and users or roles in your AWS account
- A connectivity method already selected—see [Choose how Atlan connects to Amazon Redshift](https://docs.atlan.com/llms/connectors/amazon-redshift/choose-how-atlan-connects-to-amazon-redshift/llms.txt)

## First: Choose your authentication method

| | Basic (username + password) | IAM user | IAM role |
|---|---|---|---|
| **What Atlan stores** | A database username and password | An AWS access key + secret key | A role ARN (+ external ID) - no long-lived secret |
| **How it connects** | Straight to the cluster on port 5439 | Calls the AWS API first (`GetClusterCredentials`) for short-lived credentials, then connects | Assumes your role via the AWS API first, then connects |
| **Extra AWS setup** | None | IAM policy with `redshift:GetClusterCredentials` | Cross-account role with trust policy + external ID; Serverless also needs a role tag |
| **Works with Serverless** | Yes | Yes (use the **Workgroup** field for private workgroups) | Yes - username not required; tag the role `RedshiftDbRoles: atlan_role` |
| **Pick it when** | You want the simplest path | Your policy forbids database passwords | Your policy forbids long-lived credentials entirely |

:::info IAM auth = one more traffic path

IAM user and IAM role authentication call the AWS API *before* touching your cluster. That call has its own permissions and its own error messages. If a workflow fails with an `AccessDenied` mentioning `redshift:GetClusterCredentials`, the network is fine - an IAM permission is missing. See [Troubleshooting Amazon Redshift connectivity](https://docs.atlan.com/llms/connectors/amazon-redshift/troubleshooting-amazon-redshift-connectivity/llms.txt).

:::

## Four phases at glance

| Phase | What happens | Owner | Typical time |
|---|---|---|---|
| 1. Create user | Create `atlan_user` (or `atlan_role` for Serverless) and grant read permissions | AWS / Redshift admin | 20 minutes |
| 2. IAM setup | Only for IAM auth: create the policy / role in AWS | Your cloud/network team | 20 minutes |
| 3. Network path | Allowlist Atlan's IPs, or complete the private link guide | AWS / Redshift admin + Atlan support | Minutes–days (see [method comparison](https://docs.atlan.com/llms/connectors/amazon-redshift/choose-how-atlan-connects-to-amazon-redshift/llms.txt)) |
| 4. Connect & verify | Configure the crawler, test connection, run preflight + a small crawl | Atlan User | 30 minutes |

## Phase 1 - Create database user and grant permissions

**Owner:** AWS / Redshift admin

**Provisioned clusters** - create a user and a group, then grant read access per schema:

```sql
CREATE USER atlan_user PASSWORD '<strong-password>';
CREATE GROUP atlan_users WITH USER atlan_user;

-- Repeat per schema you want cataloged:
GRANT USAGE ON SCHEMA <schema_name> TO GROUP atlan_users;
```

**Serverless** - permissions attach to a *role* instead of a user/group:

```sql
CREATE ROLE atlan_role;
GRANT USAGE ON SCHEMA <schema_name> TO ROLE atlan_role;
```

Planning to **mine query history** for lineage (provisioned only)? Also grant:

```sql
GRANT SELECT ON pg_catalog.svl_statementtext TO GROUP atlan_users;
GRANT SELECT ON pg_catalog.stl_connection_log TO GROUP atlan_users;
ALTER USER atlan_user SYSLOG ACCESS UNRESTRICTED;
```

For the complete permission reference - external schema (Glue/Spectrum) grants, permission verification, and the cloned-schema procedure for restricted environments - see [Set up Amazon Redshift](https://docs.atlan.com/llms/connectors/amazon-redshift/set-up-amazon-redshift/llms.txt).

:::tip Not the Redshift admin yourself?

Copy-paste request for your admin: *"Please create a read-only user for the data catalog per Atlan's setup page (link). It only ever reads metadata and query history—never table data, unless querying is later enabled."*

:::

## Phase 2 - IAM setup (skip for Basic auth)

**Owner:** Your cloud/network team

**IAM user:** create an IAM user with programmatic access and attach a policy that permits `redshift:GetClusterCredentials` on your cluster and the `atlan_user` database user. Hand the access key + secret key to whoever configures the crawler.

**IAM role:** create a role Atlan can assume cross-account. Atlan support provides the trusted principal and an **external ID** for the trust policy. For **Serverless**, additionally tag the role:

```
Key: RedshiftDbRoles
Value: atlan_role
```

For the complete IAM policy JSON documents (including the Serverless `redshift-serverless:GetCredentials` variant) and the role trust policy with external ID, see [Set up Amazon Redshift](https://docs.atlan.com/llms/connectors/amazon-redshift/set-up-amazon-redshift/llms.txt).

:::caution The permission that's always forgotten

`redshift:GetClusterCredentials` must cover **both** the cluster resource *and* the `dbuser` resource (for example, `arn:aws:redshift:<region>:<account>:dbuser:<cluster>/atlan_user`). Scoping it to the cluster alone produces an `AccessDenied` that looks like a network problem but isn't.

:::

## Phase 3 - Open network path

**Owner:** AWS / Redshift admin + Atlan support

Complete whichever you chose on the [comparison page](https://docs.atlan.com/llms/connectors/amazon-redshift/choose-how-atlan-connects-to-amazon-redshift/llms.txt): [Firewall & IP allowlisting](https://docs.atlan.com/llms/connectors/amazon-redshift/firewall-and-ip-allowlisting/llms.txt) (public path) or the [private network link guide](https://docs.atlan.com/llms/connectors/amazon-redshift/set-up-a-private-network-link-to-amazon-redshift/llms.txt).

## Phase 4 - Connect and verify

**Owner:** Atlan User

1. In Atlan, open **New workflow → Amazon Redshift Assets** and choose **Direct** extraction.
2. **Host Name**: the cluster endpoint from the AWS console's **Configuration** section - or, on a private link, the hostname Atlan support sent you.
3. **Port**: shown next to the endpoint; usually `5439`.
4. **Deployment Type**: Provisioned or Serverless - this changes which auth fields appear.
5. Fill in your auth method's fields and click **Test connection**.

### Success checklist

- **Test connection** passes in the Atlan UI
- Preflight checks pass when you configure the crawler
- A crawl scoped to one small schema completes
- A full crawl (and miner run, if used) completes

All four green? You're done. If any step fails, see [Troubleshooting Amazon Redshift connectivity](https://docs.atlan.com/llms/connectors/amazon-redshift/troubleshooting-amazon-redshift-connectivity/llms.txt).

## Next steps

[Set up Amazon Redshift](https://docs.atlan.com/llms/connectors/amazon-redshift/set-up-amazon-redshift/llms.txt): Grant the full set of database permissions for your deployment type and configure IAM authentication.

---