AWS redshift medium security documentation change
Summary
Updated JDBC driver documentation with explicit links and version recommendations, added ODBC driver examples, expanded IAM authentication details, and deprecated GetClusterCredentials in favor of GetCredentials API
Security assessment
The change adds explicit security documentation for IAM authentication methods, including required IAM policies and RBAC recommendations. It deprecates GetClusterCredentials in favor of GetCredentials API which offers better security controls. The addition of specific permission requirements (redshift-serverless:GetCredentials) and updated IAM policy examples directly relate to secure access management.
Diff
diff --git a/redshift/latest/mgmt/serverless-migration.md b/redshift/latest/mgmt/serverless-migration.md index 69ac24997..33de6301b 100644 --- a//redshift/latest/mgmt/serverless-migration.md +++ b//redshift/latest/mgmt/serverless-migration.md @@ -15 +15,5 @@ You can migrate your existing provisioned clusters to Amazon Redshift Serverless -To transfer data from your provisioned cluster to Amazon Redshift Serverless, create a snapshot of your provisioned cluster, and then restore the snapshot in Amazon Redshift Serverless. Amazon Redshift automatically converts interleaved keys to compound keys when you restore a provisioned cluster snapshot to a serverless namespace. +###### Note + +Amazon Redshift automatically converts interleaved keys to compound keys when you restore a provisioned cluster snapshot to a serverless namespace. + +To transfer data from your provisioned cluster to Amazon Redshift Serverless, create a snapshot of your provisioned cluster, and then restore the snapshot in Amazon Redshift Serverless. @@ -53 +57 @@ For more information about provisioned cluster snapshots, see [Amazon Redshift s -To connect to Amazon Redshift Serverless with your preferred SQL client, you can use the Amazon Redshift provided JDBC driver version 2 driver. We recommend connecting using JDBC driver version 2.1.x or later. The port number is optional. If you don’t include it, Amazon Redshift Serverless defaults to port number 5439. You can change to another port from the port range of 5431-5455 or 8191-8215. To change the default port for a serverless endpoint, use the AWS CLI and Amazon Redshift API. +To connect to Amazon Redshift Serverless with your preferred SQL client, you can use the Amazon Redshift provided [ JDBC driver version 2.x](https://docs.aws.amazon.com/redshift/latest/mgmt/jdbc20-install.html). We recommend connecting to Amazon Redshift using the latest version of the Amazon Redshift JDBC driver version 2.x. The port number is optional. If you don’t include it, Amazon Redshift Serverless defaults to port number 5439. You can change to another port from the port range of 5431-5455 or 8191-8215. To change the default port for a serverless endpoint, use the AWS CLI and Amazon Redshift API. @@ -59 +63 @@ To find the exact endpoint to use for the JDBC, ODBC, or Python driver, see **Wo -To connect using password-based authentication, use the following syntax. +To establish a connection using the Amazon Redshift JDBC driver version 2.x with password-based authentication, use the following syntax: @@ -62 +66 @@ To connect using password-based authentication, use the following syntax. - jdbc:redshift://<workgroup-name>.<account-number>.<aws-region>.redshift-serverless.amazonaws.com:5439/?username=enter a username&password=enter a password + jdbc:redshift://<workgroup-name>.<account-number>.<aws-region>.redshift-serverless.amazonaws.com:5439/?username=username&password=password @@ -64 +68 @@ To connect using password-based authentication, use the following syntax. -To connect using the Amazon Redshift Python driver, use the following syntax. +To establish a connection using the Amazon Redshift Python connector with password-based authentication, use the following syntax: @@ -71,2 +75,2 @@ To connect using the Amazon Redshift Python driver, use the following syntax. - user='enter a user', - password='enter a password' + user='username', + password='password' @@ -76,0 +81,5 @@ To connect using the Amazon Redshift Python driver, use the following syntax. +To establish a connection using the Amazon Redshift ODBC driver version 2.x with password-based authentication, use the following syntax: + + + Driver={Amazon Redshift ODBC Driver (x64)}; Server=<workgroup-name>.<account-number>.<aws-region>.redshift-serverless.amazonaws.com; Database=database-name; User=username; Password=password + @@ -79 +88,3 @@ To connect using the Amazon Redshift Python driver, use the following syntax. -If you prefer logging in with IAM, use the following driver endpoint. This driver endpoint lets you connect to a specific database and uses the Amazon Redshift Serverless [`GetCredentials`](https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_GetCredentials.html) API operation. +If you prefer logging in with IAM, use the Amazon Redshift Serverless [`GetCredentials`](https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_GetCredentials.html) API operation. + +To use IAM authentication, add `iam:` to the Amazon Redshift JDBC URL following `jdbc:redshift:`, as shown in the following example. @@ -84 +95 @@ If you prefer logging in with IAM, use the following driver endpoint. This drive -This driver endpoint doesn’t support customizing `dbUser`, `dbGroup` and `auto-create`. By default, the driver automatically creates database users at login and assigns them to groups according to the groups you defined in IAM. Note: Group names you specify in IAM must contain only lowercase letters, numbers, underscore ('_'), plus sign ('+'), period (dot), at symbol (@), or hyphen ('-'). Otherwise, the driver might not connect to `dbGroup`. +This Amazon Redshift Serverless endpoint doesn’t support customizing dbUser, dbGroup, or auto-create. By default, the driver automatically creates database users at login. It then assigns the users to Amazon Redshift database roles based on the tags specified in IAM, or based on the groups defined in your identity provider (IdP). @@ -86 +97 @@ This driver endpoint doesn’t support customizing `dbUser`, `dbGroup` and `auto -Ensure that your AWS identity has the correct IAM policy for the `RedshiftServerlessGetCredentials` action. The following is an example IAM policy that grants the correct permissions to an AWS identity to connect to Amazon Redshift Serverless. For more information about IAM permissions, see [ Add IAM Identity Permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html#add-policies-console). +Ensure that your AWS identity has the correct IAM policy for the `redshift-serverless:GetCredentials` action. The following is an example IAM policy that grants the correct permissions to an AWS identity to connect to Amazon Redshift Serverless. For more information about IAM permissions, see [Adding and removing IAM identity permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) in the _IAM User Guide_. @@ -108 +119,50 @@ JSON -### Connecting using IAM with dbUser and dbGroups +To establish a connection using the Amazon Redshift Python connector with IAM based authentication, use `iam=true` in your code, as shown in the following syntax: + + + import redshift_connector + with redshift_connector.connect( + iam=True, + host='<workgroup-name>.<account-number>.<aws-region>.redshift-serverless.amazonaws.com', + database='<database-name>' + <IAM credentials> + ) as conn: + pass + +For `IAM credentials`, you can use any credentials, including the following: + + * AWS profile configuration. + + * IAM credentials (an access key ID, secret access key, and optionally a session token). + + * Identity provider federation. + + + + +To establish a connection using the Amazon Redshift ODBC driver version 2.x with IAM based authentication and a profile, use the following syntax: + + + Driver={Amazon Redshift ODBC Driver (x64)}; IAM=true; Server=<workgroup-name>.<account-number>.<aws-region>.redshift-serverless.amazonaws.com; Database=database-name; Profile=aws-profile-name; + +### Connecting using IAM with the GetClusterCredentials API + +###### Note + +When connecting to Amazon Redshift Serverless, we recommend that you use the [`GetCredentials`](https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_GetCredentials.html) API. This API offers comprehensive role-based access control (RBAC) functionality as well as other new features that aren't available in `GetClusterCredentials`. We support the `GetClusterCredentials` API to simplify the transition from provisioned clusters to serverless workgroups, but we strongly recommend migrating to using `GetCredentials` as soon as possible for optimal compatibility. + +You can establish a connection to Amazon Redshift Serverless using the [`GetClusterCredentials`](https://docs.aws.amazon.com/redshift/latest/APIReference/API_GetClusterCredentials.html) API. To implement this authentication method, modify your client or application by incorporating the following parameters: + + * `iam=true` + + * `clusterid/cluster_identifier=redshift-serverless-<`workgroup-name`>` + + * `region=<`aws-region`>` + + + + +The following examples demonstrate the BrowserSAML plugin across all three drivers. This represents one of several available authentication approaches. The examples can be modified to use alternative authentication methods or plugins according to your specific requirements. + +#### IAM policy permissions for GetClusterCredentials + +Following is a sample IAM policy with the permissions required to use `GetClusterCredentials` with Amazon Redshift Serverless: @@ -110 +169,0 @@ JSON -If you want to use custom dbUser and dbGroups connection options, use the following driver endpoint. Like the other Amazon Redshift Serverless driver endpoint, this syntax automatically creates database users at login. This driver endpoint uses the Amazon Redshift Serverless [`GetCredentials`](https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_GetClusterCredentials.html) API operation. dbUser must begin with a letter, must contain only alphanumeric characters, underscore ('_'), plus sign ('+'), dot ('.'), at ('@'), or hyphen ('-'), and must be less than 128 characters. dbGroups must contain only lowercase letters, numbers, underscore ('_'), plus sign ('+'), period (dot), at symbol (@), or hyphen. @@ -111,0 +171,26 @@ If you want to use custom dbUser and dbGroups connection options, use the follow + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "VisualEditor0", + "Effect": "Allow", + "Action": [ + "redshift:CreateClusterUser", + "redshift:JoinGroup", + "redshift:GetClusterCredentials", + "redshift:ExecuteQuery", + "redshift:FetchResults", + "redshift:DescribeClusters", + "redshift:DescribeTable" + ], + "Resource": [ + "arn:aws:redshift:us-east-1:<account-id>:cluster:redshift-serverless-<workgroup-name>", + "arn:aws:redshift:us-east-1:<account-id>:dbgroup:redshift-serverless-<workgroup-name>", + "arn:aws:redshift:us-east-1:<account-id>:dbname:redshift-serverless-<workgroup-name>/${redshift:DbName}", + "arn:aws:redshift:us-east-1:<account-id>:dbuser:redshift-serverless-<workgroup-name>/${redshift:DbUser}" + ] + } + ] + } + +To establish a connection using the Amazon Redshift JDBC driver version 2.x with `GetClusterCredentials`, use the following syntax: @@ -113 +197,0 @@ If you want to use custom dbUser and dbGroups connection options, use the follow - jdbc:redshift:iam://redshift-serverless-<workgroup-name>:<aws-region>/<database-name> @@ -115 +199,3 @@ If you want to use custom dbUser and dbGroups connection options, use the follow -To connect using the Amazon Redshift Python driver, use the following syntax. + jdbc:redshift:iam://redshift-serverless-<workgroup-name>:<aws-region>/<database-name>?plugin_name=com.amazon.redshift.plugin.BrowserSamlCredentialsProvider&login_url=<single sign-on URL from IdP>" + +To establish a connection using the Amazon Redshift Python connector with `GetClusterCredentials`, use the following syntax: @@ -121 +207,2 @@ To connect using the Amazon Redshift Python driver, use the following syntax. - host='<workgroup-name>.<account-number>.<aws-region>.redshift-serverless.amazonaws.com', + cluster_identifier='redshift-serverless-<workgroup-name>', + region='<aws-region>', @@ -123,3 +210,2 @@ To connect using the Amazon Redshift Python driver, use the following syntax. - db_user='enter a user', - password='enter a password', - db_groups='<db-groups>' + credentials_provider='BrowserSamlCredentialsProvider' + login_url='<single sign-on URL from IdP>' @@ -130 +216,2 @@ To connect using the Amazon Redshift Python driver, use the following syntax. -### Connecting using ODBC +To establish a connection using the Amazon Redshift ODBC driver version 2.x with `GetClusterCredentials`, use the following syntax: + @@ -132 +219 @@ To connect using the Amazon Redshift Python driver, use the following syntax. -To connect using ODBC, use the following syntax. + Driver= {Amazon Redshift ODBC Driver (x64)}; IAM=true; isServerless=true; ClusterId=redshift-serverless-<workgroup-name>; region=<aws-region>; plugin_name=BrowserSAML;login_url=<single sign-on URL from IdP> @@ -133,0 +221 @@ To connect using ODBC, use the following syntax. +Following is an example ODBC DSN configuration in Windows: @@ -135 +223 @@ To connect using ODBC, use the following syntax. - Driver={Amazon Redshift (x64)}; Server=<workgroup-name>.<account-number>.<aws-region>.redshift-serverless.amazonaws.com; Database=dev +