Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon Redshift will no longer support the use of Python UDFs after June 30, 2026. We will start enforcing it in phases. For more information on the details of Python end of life and migration options, see the blog post that was published on June 30, 2025.

Prerequisites

IAM policy requirements for Amazon Redshift federated permissions setup

With Amazon Redshift federated permissions, you can centrally manage data access across your analytics workloads, with permissions managed by the Redshift warehouse directly.

To enable Amazon Redshift federated permissions, specific IAM permissions are required beyond the standard permissions needed for creating Redshift provisioned clusters and serverless namespaces.

For Redshift provisioned warehouse to enable Redshift federated permissions:

For Redshift Serverless warehouse to enable Redshift federated permissions:

If you register with the Amazon Glue Data Catalog instead of Amazon Redshift multi-warehouse, additional IAM permissions and setup are required. See Amazon Glue Data Catalog Prerequisites.

IAM Identity Center application configuration for Redshift warehouse with federated permissions

Amazon Redshift supports identity center identity propagation to seamlessly pass user identities between Redshift instances and Amazon Lake Formation and Amazon Glue services. This capability requires configuring dedicated IdC applications.

Required IAM Permissions

To create and manage the identity center application for identity center identity propagation, make sure your IAM permissions include the following permissions:

For Amazon Redshift IdC application management:

Create corresponding IdC applications and configuration

To establish identity propagation for your analytics workloads, create an Amazon Redshift IdC application of type Lakehouse. It manages permissions without requiring explicit user assignments. Redshift warehouses linked to this application require CONNECT privileges for IdC users to authenticate connections.

You can create only one Amazon Redshift IdC application of type Lakehouse per Amazon Web Services account. This application handles identity propagation across all Redshift warehouses enabled for federated permissions.

Prepare the IAM role assumed by Redshift and used by IdC identity propagation

Redshift Lakehouse IdC application creation requires an IAM role from your account with certain IAM permissions. Your IAM role used in your Redshift IdC Applications should have the following trust relationship to allow Redshift to assume it and set context for IdC identity propagation.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "redshift-serverless.amazonaws.com",
                    "redshift.amazonaws.com"
                ]
            },
            "Action": [
                "sts:AssumeRole",
                "sts:SetContext"
            ]
        }
    ]
}

And below permissions for your IdC IAM role to support IdC identity propagation.

Create a new Lakehouse type Redshift IdC application

CLI

Create your Lakehouse IdC application by specifying the Lakehouse application type in create-redshift-idc-application request, which eliminates the need for explicit user assignments in Identity Center while enabling CONNECT privileges requirement for IdC user authentication:

aws redshift create-redshift-idc-application \
--idc-instance-arn <your_idc_instance_arn> \
--idc-display-name '<name_of_idc_application_display_on_idc_console>' \
--iam-role-arn <idc_carrier_role_arn> \
--application-type Lakehouse \
--redshift-idc-application-name '<name_of_idc_display_on_redshift_console>' \
--service-integrations '[
        {
            "Redshift":[
                {
                    "Connect" : {
                        "Authorization": "Enabled"
                    }
                }
            ]
        }
    ]'

With this configuration, you can access data in Redshift warehouses using your Identity Center credentials, without additional permission assignments.

Console

1. Sign in to the Amazon Web Services Management Console and open the Amazon Redshift console at https://console.amazonaws.cn/redshiftv2/.

2. Navigate to IAM Identity Center connections page and select Create application.

3. Configure your general idc application settings.

4. Select Configure Amazon Redshift federated permissions using Amazon IAM Identity Center (Recommended) to set the application type.

5. Leave the Redshift connect identity propagation integration at its default (enabled) setting.

6. Complete the remaining cluster settings and choose Create application.

Modify an existing Redshift IdC application

If you have an existing Redshift IdC application that doesn't have the required service integrations enabled, you can update it to support identity propagation between services and clusters/namespaces.

CLI

Use the modify-redshift-idc-application command to enable Redshift:Connect authorization. This integration is essential for cross-cluster IdC identity propagation:

aws redshift modify-redshift-idc-application \
--redshift-idc-application-arn '<arn_of_the_target_redshift_idc_application>' \
--service-integrations '[
        {
            "Redshift":[
                {
                    "Connect" : {
                        "Authorization": "Enabled"
                    }
                }
            ]
        }
    ]'

Console

1. Sign in to the Amazon Web Services Management Console and open the Amazon Redshift console at https://console.amazonaws.cn/redshiftv2/.

2. Navigate to IAM Identity Center connections page and choose an existing IDC application you want to edit.

3. Choose Identity propagation integrations to enable and configure other settings and choose Save changes.

If you register with the Amazon Glue Data Catalog instead of Amazon Redshift multi-warehouse, you must also create or update a Lake Formation identity center configuration. See Amazon Glue Data Catalog Prerequisites.

Network configuration for enhanced VPC routing

If enhanced VPC routing is turned on, your VPC must be able to reach the Amazon IAM Identity Center services. Otherwise, identity propagation fails. For more information about the network requirements, see Using Amazon IAM Identity Center with enhanced VPC routing.

Connect privileges

As part of Amazon Redshift federated permissions, Amazon Redshift has introduced CONNECT privileges to manage Amazon IAM Identity Center federated users' access to Amazon Redshift workgroups or clusters. This feature is available when Amazon Redshift federated permissions are enabled on the workgroup or cluster.

This privilege enables administrators to control user access through granular permissions at each Amazon Redshift workgroup(s) or clusters(s) where Amazon Redshift federated permissions are enabled. Amazon Redshift administrator can specify which Amazon IAM Identity Center federated user(s) or group(s) have access to directly connect to the Amazon Redshift workgroup or cluster, providing fine-grained control over the Amazon IAM Identity Center user access at each workgroup or cluster.

Syntax

GRANT CONNECT [ON WORKGROUP]
TO <prefix>:<username> | ROLE <prefix>:<rolename> | PUBLIC;