View a markdown version of this page

Onboarding - Amazon Redshift
Redshift cluster registrationRedshift Serverless namespace registrationEnable Amazon IAM Identity Center identity propagationALTER USER SET GLOBAL IDENTITY
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon Redshift will no longer support the use of Python UDFs after June 30, 2026. We will start enforcing it in phases. For more information on the details of Python end of life and migration options, see the blog post that was published on June 30, 2025.

Onboarding

Redshift cluster registration

Redshift supports creating a new cluster, restoring a cluster from snapshot, or modifying an existing cluster to register it for Amazon Redshift federated permissions. When you register using the Amazon CLI, the cluster is registered with Amazon Redshift multi-warehouse federated permissions. Registration with the Amazon Glue Data Catalog is available through the Redshift console as another registration method. In both methods you provide a catalog name. To support IdC identity propagation you can specify a Redshift IdC application arn of Lakehouse type to enable IdC identity propagation.

Create a new cluster

CLI

Registering through the Amazon CLI registers your newly created cluster with Amazon Redshift multi-warehouse federated permissions. Provide the catalog-name to use for the registration. The redshift-idc-application-arn parameter is optional - include it if you want to link your cluster with the Redshift IdC Application of type Lakehouse. You can also establish this IdC application association at a later time.

aws redshift create-cluster \
    --cluster-identifier 'redshift-cluster' \
   --catalog-name 'catalog-name' \
   --redshift-idc-application-arn 'arn:aws:redshift:us-east-1:012345678912:redshiftidcapplication:3f966e50-f1b7-495c-8ace-bd0d6c3c3b17' \
   --<other_configurations_as_needed>
Console

  1. Sign in to the Amazon Web Services Management Console and open the Amazon Redshift console at https://console.amazonaws.cn/redshiftv2/.

  2. Navigate to the provisioned clusters dashboard and select Create cluster.

  3. Configure your general cluster settings.

  4. In the registration section, select Register with Amazon Redshift federated permissions and choose a registration method:

    • Amazon Redshift multi-warehouse (default): Input a catalog name identifier.

    • Amazon Glue Data Catalog: Choose to register with the Amazon Glue Data Catalog and input a catalog name identifier. This method requires the additional Data Catalog and Lake Formation setup described in Amazon Glue Data Catalog Prerequisites.

    • (Recommended) Select Amazon Redshift federated permissions using Amazon IAM Identity Center to associate with Redshift IDC application.

  5. Complete the remaining cluster settings and choose Create cluster.

Restore a new cluster

CLI

Restoring a snapshot into a new cluster through the Amazon CLI registers the cluster with Amazon Redshift multi-warehouse federated permissions. Provide the catalog-name to use for the registration. The redshift-idc-application-arn parameter is optional - include it if you want to link your cluster with the Redshift IdC Application of type Lakehouse. You can also establish this IdC application association at a later time.

aws redshift restore-from-cluster-snapshot \
   --cluster-identifier 'redshift-cluster' \
   --catalog-name 'catalog-name' \
   --snapshot-identifier 'redshift-cluster-snapshot' \
   --redshift-idc-application-arn 'arn:aws:redshift:us-east-1:012345678912:redshiftidcapplication:3f966e50-f1b7-495c-8ace-bd0d6c3c3b17' \
   --<other_configurations_as_needed>
Console

  1. Sign in to the Amazon Web Services Management Console and open the Amazon Redshift console at https://console.amazonaws.cn/redshiftv2/.

  2. Navigate to the provisioned snapshots page. From the snapshots table, select Restore to provisioned cluster from the Restore snapshot drop-down menu.

  3. Configure general cluster settings.

  4. In the registration section, select Register with Amazon Redshift federated permissions and choose a registration method:

    • Amazon Redshift multi-warehouse (default): Input a catalog name identifier.

    • Amazon Glue Data Catalog: Choose to register with the Amazon Glue Data Catalog and input a catalog name identifier. This method requires the additional Data Catalog and Lake Formation setup described in Amazon Glue Data Catalog Prerequisites.

    • (Recommended) Select Amazon Redshift federated permissions using Amazon IAM Identity Center to associate with Redshift IDC application.

  5. Complete the remaining cluster settings and choose Create cluster.

Modify an existing cluster

If your Redshift cluster is already associated to a Redshift IdC Application of type non-lakehouse, the following occurs during registration:

  • When no Redshift IdC Application ARN is provided, the existing Redshift IdC Application in your catalog will be set to disabled status.

  • When a Redshift IdC Application of type Lakehouse from different Amazon IAM Identity Center instance is specified, the current IdC provider becomes disabled

  • When a Redshift IdC Application of type Lakehouse from the same Amazon IAM Identity Center instance is provided

    • The Redshift IdC Application ARN in your catalog will be changed to the ARN of the Redshift IdC Application of type Lakehouse. The updated catalog can be checked by querying the svv_identity_providers. For more information about the svv_identity_providers, see svv_identity_providers.

    • Amazon IAM Identity Center federated users who previously had access to the Redshift cluster, must be explicitly granted CONNECT privileges by the Admins to access the cluster. For more information about granting CONNECT privileges, see Connect privileges.

    • After registering, your existing Amazon IAM Identity Center federated identities and their owned resources remain unchanged. The namespace associations for these federated identities are also preserved.

CLI

Use the modify-lakehouse-configuration command to register your cluster with Amazon Redshift multi-warehouse federated permissions. Provide the catalog-name to use for the registration. To support IdC identity propagation, specify the arn of your lakehouse type RedshiftIdcApplication.

aws redshift modify-lakehouse-configuration \
    --cluster-identifier 'redshift-cluster' \
    --lakehouse-registration Register \
    --catalog-name 'catalog-name' \
    --lakehouse-idc-registration Associate \
    --lakehouse-idc-application-arn 'arn:aws:redshift:us-east-1:012345678912:redshiftidcapplication:3f966e50-f1b7-495c-8ace-bd0d6c3c3b17' \
Console

  1. Sign in to the Amazon Web Services Management Console and open the Amazon Redshift console at https://console.amazonaws.cn/redshiftv2/.

  2. Navigate to the provisioned cluster that you want to register and select it.

  3. From the cluster's details page, select Register with Amazon Redshift multi-warehouse from the Actions drop-down menu.

  4. Choose a registration method and complete the registration:

    • Amazon Redshift multi-warehouse (default): Input a catalog name identifier.

    • Amazon Glue Data Catalog: Choose to register with the Amazon Glue Data Catalog and input a catalog name identifier. This method requires the additional Data Catalog and Lake Formation setup described in Amazon Glue Data Catalog Prerequisites.

    • (Recommended) Select Amazon Redshift federated permissions using Amazon IAM Identity Center to associate with Redshift IDC application and choose Register.

Redshift Serverless namespace registration

Redshift Serverless enables workgroup-attached Serverless namespaces to register for Amazon Redshift federated permissions. When you register through the Amazon CLI, the namespace is registered with Amazon Redshift multi-warehouse federated permissions. Registration with the Amazon Glue Data Catalog is available through the Redshift console as another registration method. Note that your database will restart during this update.

If your Redshift Serverless Namespace is already associated to a Redshift IdC Application of type non-lakehouse, the following occurs during registration:

  • When no Redshift IdC Application ARN is provided, the existing Redshift IdC Application in your catalog will be set to disabled status.

  • When a Redshift IdC Application of type Lakehouse from different Amazon IAM Identity Center instance is specified, the current IdC provider becomes disabled

  • When a Redshift IdC Application of type Lakehouse from the same Amazon IAM Identity Center instance is provided

    • The Redshift IdC Application ARN in your catalog will be changed to the ARN of the Redshift IdC Application of type Lakehouse. The updated catalog can be checked by querying the svv_identity_providers. For more information about the svv_identity_providers, see svv_identity_providers.

    • Amazon IAM Identity Center federated users who previously had access to the Redshift cluster, must be explicitly granted CONNECT privileges by the Admins to access the cluster. For more information about granting CONNECT privileges, see Connect privileges.

    • After registering, your existing Amazon IAM Identity Center federated identities and their owned resources remain unchanged. The namespace associations for these federated identities are also preserved.

CLI

Use the update-lakehouse-configuration command to register your Redshift Serverless namespace with Amazon Redshift multi-warehouse federated permissions. Provide the catalog-name to use for the registration. To support IdC identity propagation, specify the arn of a Redshift Idc Application of type Lakehouse.

aws redshift-serverless update-lakehouse-configuration \
    --namespace-name 'serverless-namespace-name' \
    --lakehouse-registration Register \
    --catalog-name 'catalog-name' \
    --lakehouse-idc-registration Associate \
    --lakehouse-idc-application-arn 'arn:aws:redshift:us-east-1:012345678912:redshiftidcapplication:3f966e50-f1b7-495c-8ace-bd0d6c3c3b17'
Console

  1. Sign in to the Amazon Web Services Management Console and open the Amazon Redshift console at https://console.amazonaws.cn/redshiftv2/.

  2. Navigate to the provisioned cluster that you want to register and select it.

  3. From the cluster's details page, select Register with Amazon Redshift multi-warehouse from the Actions drop-down menu.

  4. Choose a registration method and complete the registration:

    • Amazon Redshift multi-warehouse (default): Input a catalog name identifier.

    • Amazon Glue Data Catalog: Choose to register with the Amazon Glue Data Catalog and input a catalog name identifier. This method requires the additional Data Catalog and Lake Formation setup described in Amazon Glue Data Catalog Prerequisites.

    • (Recommended) Select Amazon Redshift federated permissions using Amazon IAM Identity Center to associate with Redshift IDC application and choose Register.

Enable Amazon IAM Identity Center identity propagation

Amazon Redshift supports Identity Center (IdC) identity propagation to seamlessly pass IdC user identities between Redshift instances and Amazon Lake Formation/Amazon Glue services.

Prerequisites

If your Redshift Cluster or Redshift Serverless Namespace is already associated to a Redshift IdC Application of type other than Lakehouse, the following occurs during registration:

  • When no Redshift IdC Application ARN is provided, the existing Redshift IdC Application in your catalog will be set to disabled status.

  • When a Redshift IdC Application of type Lakehouse from different Amazon IAM Identity Center instance is specified, the current IdC provider becomes disabled

  • When a Redshift IdC Application of type Lakehouse from the same Amazon IAM Identity Center instance is provided

    • The Redshift IdC Application ARN in your catalog will be changed to the ARN of the Redshift IdC Application of type Lakehouse. The updated catalog can be checked by querying the svv_identity_providers. For more information about the svv_identity_providers, see svv_identity_providers.

    • Amazon IAM Identity Center federated users who previously had access to the Redshift cluster, must be explicitly granted CONNECT privileges by the Admins to access the cluster. For more information about granting CONNECT privileges, see Connect privileges.

    • After registering with Amazon Redshift federated permissions, your existing Amazon IAM Identity Center federated identities and their owned resources remain unchanged. The namespace associations for these federated identities are also preserved.

Enable Amazon IAM Identity Center identity propagation for Amazon Redshift provisioned clusters

For Amazon Redshift Provisioned Cluster that registered its namespace for federated permissions, it requires Lakehouse Amazon Redshift IdC Application which doesn't require explicitly Amazon IAM Identity Center Identity user assignment to the application, the IdC users login privilege is managed by CONNECT privilege on the Redshift warehouse.

CLI

You can use modify-lakehouse-configuration command to enable IdC identity propagation for your clusters with Redshift federated permissions, specify the arn of your lakehouse type RedshiftIdcApplication, this requires a Redshift Lakehouse IdC Application please refer to Create a new Lakehouse type Redshift IdC application: Identity Center Application Configuration for Redshift Warehouse with federated permissions.

aws redshift modify-lakehouse-configuration \
    --cluster-identifier 'redshift-cluster' \
    --lakehouse-idc-registration Associate \
    --lakehouse-idc-application-arn 'arn:aws:redshift:us-east-1:012345678912:redshiftidcapplication:3f966e50-f1b7-495c-8ace-bd0d6c3c3b17' \
Console

  1. Sign in to the Amazon Web Services Management Console and open the Amazon Redshift console at https://console.amazonaws.cn/redshiftv2/.

  2. Navigate to the provisioned cluster that you want to register and select it.

  3. From the cluster's details page, select Edit Amazon Redshift multi-warehouse from the Actions drop-down menu.

  4. Select Enable from the Amazon Redshift federated permissions using Amazon IAM Identity Center drop-down to associate IDC application and choose Save changes.

Enable Amazon IAM Identity Center identity propagation for Amazon Redshift Serverless namespaces

CLI

You can use modify-lakehouse-configuration command to enable IdC identity propagation for your namespace with Redshift federated permissions, specify the arn of your lakehouse type RedshiftIdcApplication, this requires a Redshift Lakehouse IdC Application please refer to Create a new Lakehouse type Redshift IdC application: Identity Center Application Configuration for Redshift Warehouse with federated permissions.

aws redshift modify-lakehouse-configuration \
    --cluster-identifier 'redshift-cluster' \
    --lakehouse-idc-registration Associate \
    --lakehouse-idc-application-arn 'arn:aws:redshift:us-east-1:012345678912:redshiftidcapplication:3f966e50-f1b7-495c-8ace-bd0d6c3c3b17' \
Console

  1. Sign in to the Amazon Web Services Management Console and open the Amazon Redshift console at https://console.amazonaws.cn/redshiftv2/.

  2. Navigate to the serverless namespace that you want to edit registration for and select it.

  3. From the cluster's details page, select Edit Amazon Redshift multi-warehouse from the Actions drop-down menu.

  4. Select Enable from the Amazon Redshift federated permissions using Amazon IAM Identity Center drop-down to associate IDC application and choose Save changes.

ALTER USER SET GLOBAL IDENTITY

In addition to IAM and Amazon IAM Identity Center credentials, the user running queries against Redshift Warehouses with federated permissions can authenticate using an IAM role. A superuser can set an IAM role for another non-federated user to associate automatically at session establishment, and this IAM role will be assumed when making queries against Redshift Warehouses with Federated Permissions. This functionality is provided to allow Amazon IdC users to authenticate non-interactively.

This feature is useful for following use cases:

  • Customers that have large and complex setups with existing local warehouse user in addition to users with global identity.

  • Customers who use IdC, but who wish to be able to log in automatically without interactive browser action to log in.

Requirements and limitations:

  • Only super user can set the IAM role by ALTER USER.

  • IAM role must be attached to the cluster.

  • IAM role must have permissions to access resources needed to run queries on Redshift warehouses with federated permissions. We recommend using AmazonRedshiftFederatedAuthorization Amazon managed policy.

  • The users authenticating by using the GLOBAL IDENTITY IAM role can query views in Redshift Warehouses with Federated Permissions, but cannot CREATE, ALTER, REFRESH or DROP them.

Syntax

The following syntax describes the ALTER USER SET GLOBAL IDENTITY command used to set IAM role for a non-federated database user to run queries against Redshift Warehouses with Federated Permissions.

ALTER USER username SET
GLOBAL IDENTITY IAM_ROLE 'arn:aws:iam::<AWS-account-id>:role/<role-name>'

Now when authenticated as the target user (by connecting directly as username, or by using SET SESSION AUTHORIZATION ), you can check global identity role using

SHOW GLOBAL IDENTITY

Note, the global identity role is associated with the user on session establishment. If you set the global identity for the currently logged in user, that user will need to reconnect for global identity to take effect.

The following command can be used to remove the associated IAM role.

ALTER USER username RESET GLOBAL IDENTITY

Parameters

username

Name of the user. Cannot be a federated users, like IAM user or Amazon IdC user.

IAM_ROLE 'arn:aws:iam::<account-id>:role/<role-name>'

Use the Amazon Resource Name (ARN) for an IAM role that your cluster uses for authentication and authorization when user username runs queries on Redshift warehouses with federated permissions. This role needs to have the required permissions to run the query. We recommend using AmazonRedshiftFederatedAuthorization Amazon Managed Policy.