AWS redshift medium security documentation change

Service: redshift · 2026-02-22 · Security-related medium

File: redshift/latest/mgmt/odbc20-configuration-options.md

Summary

Added new idp_partition parameter with documentation for Azure AD authentication endpoints

Security assessment

Introduces a new security configuration parameter (idp_partition) to specify cloud partitions for authentication endpoints. Concrete evidence: Parameter defines secure endpoints for government/China clouds (e.g., login.microsoftonline.us). Misconfiguration could compromise authentication security.

Diff

diff --git a/redshift/latest/mgmt/odbc20-configuration-options.md b/redshift/latest/mgmt/odbc20-configuration-options.md
index 4f5749c90..41c875dc4 100644
--- a//redshift/latest/mgmt/odbc20-configuration-options.md
+++ b//redshift/latest/mgmt/odbc20-configuration-options.md
@@ -5 +5 @@
-AccessKeyIDapp_idApplicationNameapp_nameAuthProfileAuthTypeAutoCreateCaFileclient_id client_ secretClusterIdcompressionDatabaseDatabaseMetadataCurrentDbOnlydbgroups_filterDriverDSNEndpointUrlForceLowercasegroup_federationhttps_proxy_hosthttps_proxy_passwordhttps_proxy_porthttps_proxy_usernameIAMidc_client_display_nameidc_regionidp_hostidp_portidp_response_timeoutidp_tenantidp_use_https_proxyInstanceProfileissuer_urlKeepAliveKeepAliveCountKeepAliveIntervalKeepAliveTimelisten_portlogin_urlloginToRpLogLevelLogPathMin_TLSpartner_spidPassword | PWSplugin_namePort | PortNumberpreferred_roleProfileprovider_nameProxyHostProxyPortProxyPwdProxyUidReadOnlyregionSecretAccessKeySessionTokenServer | HostName | Hostssl_insecureSSLModeStsConnectionTimeoutStsEndpointUrltokentoken_typeUID | User | LogonIDweb_identity_token
+AccessKeyIDapp_idApplicationNameapp_nameAuthProfileAuthTypeAutoCreateCaFileclient_id client_ secretClusterIdcompressionDatabaseDatabaseMetadataCurrentDbOnlydbgroups_filterDriverDSNEndpointUrlForceLowercasegroup_federationhttps_proxy_hosthttps_proxy_passwordhttps_proxy_porthttps_proxy_usernameIAMidc_client_display_nameidc_regionidp_hostidp_portidp_response_timeoutidp_tenantidp_partitionidp_use_https_proxyInstanceProfileissuer_urlKeepAliveKeepAliveCountKeepAliveIntervalKeepAliveTimelisten_portlogin_urlloginToRpLogLevelLogPathMin_TLSpartner_spidPassword | PWSplugin_namePort | PortNumberpreferred_roleProfileprovider_nameProxyHostProxyPortProxyPwdProxyUidReadOnlyregionSecretAccessKeySessionTokenServer | HostName | Hostssl_insecureSSLModeStsConnectionTimeoutStsEndpointUrltokentoken_typeUID | User | LogonIDweb_identity_token
@@ -492,0 +493,22 @@ This parameter is required if authenticating through the Azure AD service.
+## idp_partition
+
+  * Default Value – None
+
+  * Data Type – String
+
+
+
+
+Specifies the cloud partition where your identity provider (IdP) is configured. This determines which IdP authentication endpoint the driver connects to.
+
+If this parameter is left blank, the driver defaults to the commercial partition. Possible values are:
+
+  * `us-gov`: Use this value if your IdP is configured in Azure Government. For example, Azure AD Government uses the endpoint `login.microsoftonline.us`.
+
+  * `cn`: Use this value if your IdP is configured in the China cloud partition. For example, Azure AD China uses the endpoint `login.chinacloudapi.cn`.
+
+
+
+
+This parameter is optional.
+