Amazon Redshift will no longer support the use of Python UDFs after June 30, 2026. We will start enforcing it in phases. For more information on the details of Python end of life and migration options, see the [ blog post ](https://amazonaws-china.com/blogs/big-data/amazon-redshift-python-user-defined-functions-will-reach-end-of-support-after-june-30-2026/) that was published on June 30, 2025. 

# Using Amazon IAM Identity Center authentication with enhanced VPC routing
<a name="redshift-iam-access-control-idp-connect-evr"></a>

When [enhanced VPC routing](https://docs.amazonaws.cn/redshift/latest/mgmt/enhanced-vpc-routing.html) is turned on, Redshift routes traffic through your virtual private cloud (VPC) instead of over the internet. This includes the calls that Redshift makes to authenticate an Amazon IAM Identity Center user. This applies whether the user signs in interactively or connects with an Amazon IAM Identity Center token obtained through trusted identity propagation. For these connections to succeed, Redshift must be able to reach Amazon IAM Identity Center from your VPC. Interface VPC endpoints are the recommended way to provide this connectivity. They let your provisioned cluster or Amazon Redshift Serverless workgroup reach Amazon IAM Identity Center over the Amazon network.

**Important**  
These requirements apply to any connection authenticated through Amazon IAM Identity Center. IAM users and local database users authenticate through different mechanisms and aren't affected. If enhanced VPC routing is turned off, these endpoints aren't required.

**Note**  
Changing enhanced VPC routing restarts a provisioned cluster. For more information about turning on enhanced VPC routing, see [Turning on enhanced VPC routing](https://docs.amazonaws.cn/redshift/latest/mgmt/enhanced-vpc-enabling-cluster.html).

## Interface VPC endpoints
<a name="redshift-iam-access-control-idp-connect-evr-endpoints"></a>

Create the following interface VPC endpoints (Amazon PrivateLink) in the VPC where your cluster or workgroup resides. Both endpoints are required. If either endpoint is missing or unreachable, Amazon IAM Identity Center sign-in fails.

`com.amazonaws.{{region}}.sso-oauth`  
Validates the Amazon IAM Identity Center access token that the user presents at sign-in and exchanges it for a token scoped to your Redshift session.

`com.amazonaws.{{region}}.identitystore`  
Resolves the user and their Amazon IAM Identity Center group memberships from the Amazon IAM Identity Center identity store.

For information about creating an interface VPC endpoint, see [Create a VPC endpoint](https://docs.amazonaws.cn/vpc/latest/userguide/vpce-interface.html#create-interface-endpoint) in the *Amazon VPC User Guide*.

Before you create the endpoints, confirm that the `DNS hostnames` and `DNS resolution` attributes are turned on for the VPC where your cluster or workgroup runs. Private DNS names depend on both attributes. For more information, see [DNS attributes for your VPC](https://docs.amazonaws.cn/vpc/latest/userguide/vpc-dns.html#vpc-dns-support) in the *Amazon VPC User Guide*.

Enhanced VPC routing requires that your provisioned cluster or Redshift Serverless workgroup is not publicly accessible.

When you create each endpoint, do the following:
+ **Turn on private DNS names** – Redshift connects to these services using their standard DNS names. Without private DNS names, those names continue to resolve to public addresses and the calls don't route to your endpoints.
+ **Create the endpoints in the Amazon IAM Identity Center Region** – Amazon IAM Identity Center is a Regional service. Create these endpoints in the Region where your Amazon IAM Identity Center instance runs. If your cluster or workgroup runs in a different Region and you don't use Amazon IAM Identity Center multi-Region replication, use the cross-Region endpoint option so that the endpoints reach the Amazon IAM Identity Center Region.
+ **Choose subnets in the same Availability Zones** – Select subnets in the Availability Zones that your cluster or workgroup uses.
+ **Allow inbound HTTPS** – The security group attached to each endpoint must allow inbound traffic on TCP port 443 from your cluster or workgroup subnets.
+ **Keep the default endpoint policy** – The default policy allows full access. If your organization requires a restrictive endpoint policy, scope it by principal rather than by a list of actions. Then verify that sign-in still succeeds.

## Using Amazon Network Firewall
<a name="redshift-iam-access-control-idp-connect-evr-firewall"></a>

Amazon Network Firewall is optional. If you filter outbound traffic with Amazon Network Firewall instead of using interface VPC endpoints, the firewall policy must allow the Amazon IAM Identity Center service domains. Otherwise sign-in fails when Redshift can't reach them. Add the following domains to your firewall's allow list, replacing {{region}} with your Amazon IAM Identity Center Region:

`oidc.{{region}}.amazonaws.com`  
Validates the Amazon IAM Identity Center access token and exchanges it for a token scoped to your Redshift session.

`.sso.{{region}}.amazonaws.com`  
Reaches the Amazon IAM Identity Center service to resolve the Amazon IAM Identity Center application and its assignments.

`identitystore.{{region}}.amazonaws.com`  
Resolves the user and their Amazon IAM Identity Center group memberships.

If your firewall uses a deny-by-default policy, it must also allow the domains that Redshift uses for general operation under enhanced VPC routing, such as Amazon S3 and, if you query a data lake, Amazon Glue. For more information, see [Enhanced VPC routing in Amazon Redshift](https://docs.amazonaws.cn/redshift/latest/mgmt/enhanced-vpc-routing.html).

Using interface VPC endpoints, as described in [Interface VPC endpoints](#redshift-iam-access-control-idp-connect-evr-endpoints), keeps this traffic on the Amazon network and doesn't require firewall allow-listing.