Skip to content
Docs

Amazon Redshift

Connect Adverity Atlas to Amazon Redshift, provisioned clusters or Redshift Serverless.

Prerequisites

A user or role that can read the data you want to query. Adverity Atlas only issues read queries against your tables, it does not create, modify, or drop them, so read access is all it needs.

What Adverity Atlas reads

A sync lists the objects in each schema you bind and records what kind each one is. Profiling then runs aggregate queries over the types it can profile, and those field statistics are what Chat and the glossary work from. An object that is discovered but not profiled is still queryable, it just carries no statistics.

Object type

Discovered and queryable

Profiled

Tables

Yes

Yes

Views

Yes

No

Materialized views

Yes

Yes

Materialized views are read from the STV_MV_INFO catalog. If that catalog is not readable, the sync records no materialized views for that schema rather than failing, so the rest of the schema still syncs.

Querying and profiling need the same access: SELECT on the objects you want available. Profiling adds no privilege of its own, it reads the same objects with aggregate queries. The Connection test on the wizard’s Test step proves exactly that access, in the order a sync needs it: connect, list the schemas, list the tables in the target schema, and read a row.

Authentication methods

Amazon Redshift supports 4 authentication methods. Choose the one that matches your security posture.

Username & Password

Sign in with a native Redshift database user and password.

Best for: A native Redshift database user; simplest to set up.

Credentials:

Field

Description

Username

e.g. awsuser

Required

Password

Stored encrypted.

Required

IAM Role (default credential chain)

Use whichever AWS credentials the platform already has (env vars, instance profile, EKS pod role) to fetch temporary Redshift credentials. No stored secrets.

Best for: Adverity Atlas running inside AWS, temporary credentials, no stored secrets.

No credentials are stored for this method.

IAM Access Keys

Provide a static AWS access key id and secret for IAM auth.

Best for: IAM auth when Adverity Atlas runs outside AWS.

Credentials:

Field

Description

Access Key ID

e.g. AKIA...

Required

Secret Access Key

Stored encrypted.

Required

Session Token

Stored encrypted.

Optional

IAM Assume Role (STS)

Assume an IAM role via STS to fetch temporary Redshift credentials, useful for cross-account access.

Best for: Cross-account access.

Credentials:

Field

Description

Role ARN

e.g. arn:aws:iam::123456789012:role/RedshiftReader

Required

External ID

Optional

Setup

  1. Go to Settings > Data Governance > Data Sources. Under Add Connection, choose Amazon Redshift. The Add a data source wizard opens and runs in five steps.

  2. Source, confirm Amazon Redshift is selected and click Continue.

  3. Auth method, pick one of the methods above and click Continue.

  4. Authenticate, fill in the Configuration and Credentials fields and click Save credentials, then click Continue.

  5. Test, Adverity Atlas tests the connection as soon as you arrive and shows the result under Connection test. Continue unlocks once the test passes. After fixing a failure, click Test again. Back discards the saved credentials and returns you to Authenticate, with the configuration still filled in.

  6. Review & create, enter a Name, choose a Sync schedule, and pick a Mode: Active (sync runs on schedule and agents can query this source), Development (sync runs, but agents cannot query it yet), or Disabled (no automated operations). Then click Create data source.

The Connection test runs the full connection diagnostic: it authenticates, lists the visible schemas, lists the tables in the target schema, and reads a row. You cannot continue to Review & create until every check passes, so a wrong credential or a missing grant is resolved here rather than becoming an unhealthy source afterwards. A failed check reports the warehouse’s own error, and the grant that is missing where Adverity Atlas can work it out, see Connection diagnostics. A test that could not run at all says “The connection test could not run. Try again in a moment.”

Adverity Atlas verifies the connection as soon as the source is created, and starts the first sync when verification succeeds and the mode allows it. Schema discovery and field profiling run from that sync.

Tip

If someone else holds the credentials, use Share a one-time link under Or ask someone else on the Authenticate step. They submit the credentials through that link and see the connection test run on their page too. If it fails, Provide credentials again lets them correct what they entered. Your wizard moves on to Test once they submit, so the secret never passes through you.

Connection fields

These appear under Configuration on the wizard’s Authenticate step.

Note

IAM authentication needs the extra IAM fields below: AWS Region plus either Cluster Identifier (provisioned) or Serverless Workgroup (Serverless), and Database User. They are ignored for username/password auth.

Field

Description

Host

e.g. my-cluster.abc123.eu-west-1.redshift.amazonaws.com

Required

Port

e.g. 5439

Optional

Database

e.g. dev

Required

SSL Mode

e.g. verify-ca

Optional

AWS Region (IAM auth)

e.g. eu-west-1

Optional

Cluster Identifier (IAM, provisioned)

e.g. my-cluster

Optional

Serverless Workgroup (IAM, Serverless)

e.g. default

Optional

Database User (IAM auth)

e.g. awsuser

Optional

Troubleshooting

Symptom

Likely cause

“password authentication failed”

Wrong database user, or the user does not exist on that database.

IAM auth returns no credentials

Cluster Identifier or Serverless Workgroup does not match the target, or the identity lacks redshift:GetClusterCredentials.

Connection times out

The cluster’s security group does not allow the Adverity Atlas network, or it is not publicly accessible.

Profiling fails for one table with the warehouse’s permission error

The role cannot read any column of that table. A table where only some columns are denied (column-level grants) still profiles, with the denied columns left without statistics.

What’s next?

Was this page helpful?