View a markdown version of this page

Amazon Glue Data Catalog Prerequisites - Amazon Redshift
IAM permissions for Amazon Glue Data Catalog registrationLake Formation integration for the Redshift IdC applicationCreate Lake Formation identity center configurationAmazon Glue Data Catalog prerequisites
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon Redshift will no longer support the use of Python UDFs after June 30, 2026. We will start enforcing it in phases. For more information on the details of Python end of life and migration options, see the blog post that was published on June 30, 2025.

Amazon Glue Data Catalog Prerequisites

The following setup is required only if you register your warehouse with the Amazon Glue Data Catalog (available through the Redshift console). It is not required for Amazon Redshift multi-warehouse federated permissions, which is managed directly by Redshift.

IAM permissions for Amazon Glue Data Catalog registration

For Amazon Glue Data Catalog integration to create a catalog with Redshift federated permissions:

  • glue:CreateCatalog

  • glue:GetCatalog

For Lake Formation resource registration as one-time registration to enable Redshift federated permissions from a remote warehouse:

  • lakeformation:RegisterResource

  • lakeformation:RegisterResourceWithPrivilegedAccess

For Lake Formation IdC application management:

  • lakeformation:CreateLakeFormationIdentityCenterConfiguration

  • lakeformation:DescribeLakeFormationIdentityCenterConfiguration

  • lakeformation:UpdateLakeFormationIdentityCenterConfiguration

Lake Formation integration for the Redshift IdC application

When you register with the Amazon Glue Data Catalog, the Amazon Redshift IdC application of type Lakehouse must also enable the LakeFormation service integration (in addition to Redshift:Connect). Use the same create-redshift-idc-application or modify-redshift-idc-application commands described in IAM Identity Center application configuration for Redshift warehouse with federated permissions, with the Lake Formation integration added.

Create (CLI)

Add the LakeFormation integration when creating your Lakehouse IdC application:

aws redshift create-redshift-idc-application \
--idc-instance-arn <your_idc_instance_arn> \
--idc-display-name '<name_of_idc_application_display_on_idc_console>' \
--iam-role-arn <idc_carrier_role_arn> \
--application-type Lakehouse \
--redshift-idc-application-name '<name_of_idc_display_on_redshift_console>' \
--service-integrations '[
        {
            "LakeFormation":[
                {
                    "LakeFormationQuery":{"Authorization": "Enabled"}
                }
            ]
        },
        {
            "Redshift":[
                {
                    "Connect" : {
                        "Authorization": "Enabled"
                    }
                }
            ]
        }
    ]'

With this configuration, you can access data across services using your Identity Center credentials, without additional permission assignments.

Modify (CLI)

Use the modify-redshift-idc-application command to enable both LakeFormation:query authorization and Redshift:Connect authorization. These integrations are essential for cross-service and cross-cluster IdC identity propagation:

aws redshift modify-redshift-idc-application \
--redshift-idc-application-arn '<arn_of_the_target_redshift_idc_application>' \
--service-integrations '[
        {
            "LakeFormation":[
                {
                    "LakeFormationQuery":{"Authorization": "Enabled"}
                }
            ]
        },
        {
            "Redshift":[
                {
                    "Connect" : {
                        "Authorization": "Enabled"
                    }
                }
            ]
        }
    ]'

Create Lake Formation identity center configuration

Your Lake Formation service requires a dedicated IdC application if one has not been created yet. You must also enable Redshift:Connect authorization for the configuration to function properly.

CLI

Use the create-lake-formation-identity-center-configuration command to enable Redshift:Connect authorization. These integrations are essential for Lake Formation propagates IdC identity to Redshift clusters and Redshift Serverless Namespaces

aws lakeformation  create-lake-formation-identity-center-configuration \
--instance-arn <your_idc_instance_arn> \
--service-integrations '[{
  "Redshift": [{
    "RedshiftConnect": {
      "Authorization": "ENABLED"
    }
  }]
}]'
Console

  1. Sign in to the Amazon Web Services Management Console, and open the Lake Formation console at https://console.amazonaws.cn/lakeformation/.

  2. In the left navigation pane, select IAM Identity Center integration.

  3. On the IAM Identity Center integration page you can enable trusted identity propagation for Amazon Redshift connect. Lake Formation propagates identity to downstream based on the effective permissions, so that authorized applications can access data on behalf of users.

Update Lake Formation identity center configuration

If you had configured Lake Formation IdC application that doesn't have the required service integrations enabled, you can update it to support identity propagation between services and clusters/namespaces.

CLI

Use the update-lake-formation-identity-center-configuration command to enable Redshift:Connect authorization. These integrations are essential for cross-service and cross-cluster IdC identity propagation:

aws lakeformation update-lake-formation-identity-center-configuration \
--service-integrations '[{                                                            
  "Redshift": [{
    "RedshiftConnect": {
      "Authorization": "ENABLED"
    }
  }]
}]'
Console

  1. Sign in to the Amazon Web Services Management Console, and open the Lake Formation console at https://console.amazonaws.cn/lakeformation/.

  2. In the left navigation pane, select IAM Identity Center integration.

  3. On the IAM Identity Center integration page you can enable trusted identity propagation for Amazon Redshift connect. Lake Formation propagates identity to downstream based on the effective permissions, so that authorized applications can access data on behalf of users.

Amazon Glue Data Catalog prerequisites

You need Lake Formation CREATE_CATALOG permissions to enable Amazon Glue Data Catalog with Amazon Redshift federated permissions.

  1. If the account belongs to an existing Lake Formation customer, the Lake Formation administrator must explicitly grant CREATE_CATALOG permission to each cluster creator. Use the following sample CLI command:

    aws lakeformation grant-permissions \
    --cli-input-json \
    '{
        "Principal": {
            "DataLakePrincipalIdentifier": "<PrincipalArn>"
        },
        "Resource": {
            "Catalog": {}
        },
        "Permissions": [
            "CREATE_CATALOG"
        ]
    }'

  2. If the account has never used Lake Formation, verify that Catalog Creators is set to IAMAllowedPrincipals in the Administrative Roles and Tasks page of the Lake Formation console. If not configured, set up a Data Lake Administrator by following the Create a data lake administrator. Alternatively, you can create a Data Lake Administrator with the minimum required policies if you will only use Amazon Glue Data Catalog with Amazon Redshift federated permissions.

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Action": [
                "lakeformation:PutDataLakeSettings",
                "lakeformation:GrantPermissions",
                "lakeformation:GetDataLakeSettings",
                "lakeformation:BatchGrantPermissions",
                "lakeformation:ListPermissions"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

  3. Have the DataLake Admin grant permissions to the IAMAllowedPrincipals to Create Catalog. Access can be granted through the Grant button for Catalog Creators in the Administrative Role and Tasks page.