Setting up trusted identity propagation with Amazon Redshift Query Editor V2

Create an IAM role in the account where the Amazon Redshift cluster or Serverless instance exists with the following permission policy. For more information, see IAM Role creation.

1. The following policy examples includes the necessary permissions to complete this tutorial. To use this policy, replace the italicized placeholder text in the example policy with your own information. For additional directions, see Create a policy or Edit a policy.

   Permission policy:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "AllowRedshiftApplication",
               "Effect": "Allow",
               "Action": [
                   "redshift:DescribeQev2IdcApplications",
                   "redshift-serverless:ListNamespaces",
                   "redshift-serverless:ListWorkgroups",
                   "redshift-serverless:GetWorkgroup"
               ],
               "Resource": "*"
           },
           {
               "Sid": "AllowIDCPermissions",
               "Effect": "Allow",
               "Action": [
                   "sso:DescribeApplication",
                   "sso:DescribeInstance"
               ],
               "Resource": [
                   "arn:aws:sso:::instance/Your-IAM-Identity-Center-Instance ID",
                   "arn:aws:sso::Your-AWS-Account-ID:application/Your-IAM-Identity-Center-Instance-ID/*"
               ]
           }
       ]
   }

   Trust policy:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "Service": [
                       "redshift-serverless.amazonaws.com",
                       "redshift.amazonaws.com"
                   ]
               },
               "Action": [
                   "sts:AssumeRole",
                   "sts:SetContext"
               ]
           }
       ]
   }
                                       

Create a permission set in the Amazon Organizations management account where IAM Identity Center is enabled. You’ll use it in the next step to allow federated users to access Redshift Query Editor V2.

1. Go to the IAM Identity Center console, under Multi-Account permissions, choose Permission sets.

2. Choose Create permission set.

3. Choose Custom permission set and then choose Next.

4. Under Amazon managed policies, choose AmazonRedshiftQueryEditorV2ReadSharing.

5. Under Inline policy, add the following policy:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "Statement1",
               "Effect": "Allow",
               "Action": [
                   "redshift:DescribeQev2IdcApplications",
                   "redshift-serverless:ListNamespaces",
                   "redshift-serverless:ListWorkgroups",
                   "redshift-serverless:GetWorkgroup"
               ],
               "Resource": "*"
           }
       ]
   }

6. Select Next and then provide a name for the permission set name. For example, Redshift-Query-Editor-V2.

7. Under Relay state – optional, set default relay state to the Query Editor V2 URL, using the format: https://your-region.console.aws.amazon.com/sqlworkbench/home.

8. Review the settings and choose Create.

9. Navigate to the IAM Identity Center Dashboard and copy the Amazon Web Services access portal URL from the Setting Summary section.

   

10. Open a new Incognito Browser Window and paste the URL.

    This will take you to your Amazon Web Services access portal, ensuring you are signing in with an IAM Identity Center user.

    

    For more information about permission set, see Manage Amazon Web Services accounts with permission sets.

Enable federated users access to Redshift Query Editor V2.

1. In the Amazon Organizations management account, open the IAM Identity Center console.

2. In the navigation pane, under Multi-account permissions, choose Amazon Web Services accounts.

3. On the Amazon Web Services accounts page, select the Amazon Web Services account that you want to assign access to.

4. Choose Assign users or groups.

5. On the Assign users and groups page, choose the users and or groups that you want to create the permission set for. Then, choose Next.

6. On the Assign permission sets page, choose the permission set you created in the previous step. Then, choose Next.

7. On the Review and submit assignments page, review your selections and choose Submit.