View a markdown version of this page

Using Amazon IAM Identity Center authentication with enhanced VPC routing - Amazon Redshift
Interface VPC endpointsUsing Amazon Network Firewall
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon Redshift will no longer support the use of Python UDFs after June 30, 2026. We will start enforcing it in phases. For more information on the details of Python end of life and migration options, see the blog post that was published on June 30, 2025.

Using Amazon IAM Identity Center authentication with enhanced VPC routing

When enhanced VPC routing is turned on, Redshift routes traffic through your virtual private cloud (VPC) instead of over the internet. This includes the calls that Redshift makes to authenticate an Amazon IAM Identity Center user. This applies whether the user signs in interactively or connects with an Amazon IAM Identity Center token obtained through trusted identity propagation. For these connections to succeed, Redshift must be able to reach Amazon IAM Identity Center from your VPC. Interface VPC endpoints are the recommended way to provide this connectivity. They let your provisioned cluster or Amazon Redshift Serverless workgroup reach Amazon IAM Identity Center over the Amazon network.

Important

These requirements apply to any connection authenticated through Amazon IAM Identity Center. IAM users and local database users authenticate through different mechanisms and aren't affected. If enhanced VPC routing is turned off, these endpoints aren't required.

Note

Changing enhanced VPC routing restarts a provisioned cluster. For more information about turning on enhanced VPC routing, see Turning on enhanced VPC routing.

Interface VPC endpoints

Create the following interface VPC endpoints (Amazon PrivateLink) in the VPC where your cluster or workgroup resides. Both endpoints are required. If either endpoint is missing or unreachable, Amazon IAM Identity Center sign-in fails.

com.amazonaws.region.sso-oauth

Validates the Amazon IAM Identity Center access token that the user presents at sign-in and exchanges it for a token scoped to your Redshift session.

com.amazonaws.region.identitystore

Resolves the user and their Amazon IAM Identity Center group memberships from the Amazon IAM Identity Center identity store.

For information about creating an interface VPC endpoint, see Create a VPC endpoint in the Amazon VPC User Guide.

Before you create the endpoints, confirm that the DNS hostnames and DNS resolution attributes are turned on for the VPC where your cluster or workgroup runs. Private DNS names depend on both attributes. For more information, see DNS attributes for your VPC in the Amazon VPC User Guide.

Enhanced VPC routing requires that your provisioned cluster or Redshift Serverless workgroup is not publicly accessible.

When you create each endpoint, do the following:

  • Turn on private DNS names – Redshift connects to these services using their standard DNS names. Without private DNS names, those names continue to resolve to public addresses and the calls don't route to your endpoints.

  • Create the endpoints in the Amazon IAM Identity Center Region – Amazon IAM Identity Center is a Regional service. Create these endpoints in the Region where your Amazon IAM Identity Center instance runs. If your cluster or workgroup runs in a different Region and you don't use Amazon IAM Identity Center multi-Region replication, use the cross-Region endpoint option so that the endpoints reach the Amazon IAM Identity Center Region.

  • Choose subnets in the same Availability Zones – Select subnets in the Availability Zones that your cluster or workgroup uses.

  • Allow inbound HTTPS – The security group attached to each endpoint must allow inbound traffic on TCP port 443 from your cluster or workgroup subnets.

  • Keep the default endpoint policy – The default policy allows full access. If your organization requires a restrictive endpoint policy, scope it by principal rather than by a list of actions. Then verify that sign-in still succeeds.

Using Amazon Network Firewall

Amazon Network Firewall is optional. If you filter outbound traffic with Amazon Network Firewall instead of using interface VPC endpoints, the firewall policy must allow the Amazon IAM Identity Center service domains. Otherwise sign-in fails when Redshift can't reach them. Add the following domains to your firewall's allow list, replacing region with your Amazon IAM Identity Center Region:

oidc.region.amazonaws.com

Validates the Amazon IAM Identity Center access token and exchanges it for a token scoped to your Redshift session.

.sso.region.amazonaws.com

Reaches the Amazon IAM Identity Center service to resolve the Amazon IAM Identity Center application and its assignments.

identitystore.region.amazonaws.com

Resolves the user and their Amazon IAM Identity Center group memberships.

If your firewall uses a deny-by-default policy, it must also allow the domains that Redshift uses for general operation under enhanced VPC routing, such as Amazon S3 and, if you query a data lake, Amazon Glue. For more information, see Enhanced VPC routing in Amazon Redshift.

Using interface VPC endpoints, as described in Interface VPC endpoints, keeps this traffic on the Amazon network and doesn't require firewall allow-listing.