Redshift

Private preview: The Redshift integration is currently in private preview. To enable it for your account, please contact support.

Euno's Redshift integration connects to provisioned Amazon Redshift clusters and Redshift Serverless workgroups to discover databases, schemas, tables, views, materialized views, Spectrum external tables, columns, lineage, and optional query-history usage.

The integration supports one source type for both:

• Provisioned Redshift clusters

• Redshift Serverless workgroups

Setting up Redshift integration

Overview

Redshift stores data in databases. Each database contains schemas, and each schema contains tables, views, materialized views, Spectrum external tables, and columns.

Euno connects to the cluster or workgroup endpoint over SQL and reads Redshift system catalog views. System schemas such as pg_* and information_schema are excluded from discovery.

Step 1: Prepare Redshift

1. Confirm that Euno can reach the cluster or workgroup endpoint. The default port is 5439.

2. Note the hostname, port, database used for discovery, and whether the deployment is provisioned or serverless.

3. Create a dedicated database user for Euno.

Ensure Redshift is reachable

1. Allow inbound traffic from the Euno runtime network or through your private connectivity setup. See Local Agents when the cluster or workgroup is inside a private network.

2. If metadata security is enabled, grant schema visibility (USAGE on each schema, or ACCESS CATALOG) for every schema Euno should discover.

Step 2: Grant permissions

Use a dedicated Redshift role and user for Euno. Catalog discovery plus ACCESS SYSTEM TABLE (or sys:operator) is required for query-history lineage.

Recommended grants:

CREATE ROLE euno_role;
CREATE USER euno_user PASSWORD 'REPLACE_WITH_STRONG_PASSWORD';
GRANT ROLE euno_role TO euno_user;

GRANT CONNECT ON DATABASE analytics TO ROLE euno_role;
GRANT ACCESS CATALOG TO ROLE euno_role;
GRANT ACCESS SYSTEM TABLE TO ROLE euno_role;

Permission	Used for
CONNECT on the database, plus USAGE per schema or ACCESS CATALOG	Catalog discovery of databases, schemas, tables, views, columns, and Spectrum external tables
Readable view definitions	View SQL and definition-based lineage
ACCESS SYSTEM TABLE or sys:operator	Query-history lineage and usage. Older clusters may also need SYSLOG ACCESS UNRESTRICTED for the STL_* fallback
ACCESS SYSTEM TABLE or sys:monitor	Table row counts and storage size metadata

Access limited to the Euno user's own queries is not enough. Account-wide query history is required for lineage.

S3 and Glue IAM permissions are not required. Spectrum metadata is read through Redshift.

Step 3: Choose an authentication method

Password authentication and IAM database authentication are mutually exclusive.

• Password: provide User and Password.

• IAM: enable IAM authentication in Advanced and provide the cluster identifier or workgroup name, AWS region, and database user name.

IAM database authentication (optional)

Provisioned cluster

1. Enable IAM database authentication on the cluster.

2. Attach an IAM policy allowing redshift:GetClusterCredentials and redshift:DescribeClusters to the role Euno uses.

3. CREATE USER euno_iam WITH PASSWORD DISABLE;

4. GRANT ROLE euno_role TO euno_iam;

5. Associate the IAM role with the database user per AWS IAM authentication for Redshift.

Serverless workgroup

1. Enable IAM authentication on the workgroup.

2. IAM policy: redshift-serverless:GetCredentials, redshift-serverless:GetWorkgroup.

3. Same database user and role grants as above.

Example IAM policy for a provisioned cluster (replace region, account, cluster, and database names):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "redshift:GetClusterCredentials",
        "redshift:DescribeClusters"
      ],
      "Resource": [
        "arn:aws:redshift:REGION:ACCOUNT_ID:cluster:CLUSTER_ID",
        "arn:aws:redshift:REGION:ACCOUNT_ID:dbuser:CLUSTER_ID/euno_user",
        "arn:aws:redshift:REGION:ACCOUNT_ID:dbname:CLUSTER_ID/analytics"
      ]
    }
  ]
}

Step 4: Configure Euno's Redshift source

Asterisk (*) means a mandatory field.

Configuration	Description
Name*	Enter a name for your Redshift source (for example, Redshift - Analytics).
Deployment mode*	provisioned or serverless.
Host*	Cluster or workgroup endpoint. Do not include a protocol.
Port	Redshift TCP port. Defaults to 5439.
Database*	Database used for connection and discovery.
User	Username for password authentication. Required when using a password.
Password	Password for password authentication. Required when using a password.

Step 5: Schedule

1. Enable the Schedule option.

2. Choose:

   1. Weekly: Set specific days and times.

   2. Hourly: Define the interval in hours.

Step 6: Resource Cleanup

• Immediate Cleanup: Remove resources not detected in the most recent successful source integration run.

• No Cleanup: Keep all resources indefinitely, even if they are no longer detected.

For a detailed explanation on Euno's cleanup strategies, see Resource Sponsorship in Euno.

Step 7: Advanced Settings

Click Advanced to display these additional settings.

Configuration	Description
Use IAM authentication	Authenticate with IAM instead of a database password. Provide cluster identifier or workgroup name, AWS region, and the database user name.
Override hostname for URIs	Stable hostname used in generated redshift. URIs when the connection host is not the canonical warehouse hostname.
Extract Usage Metrics	Collect query-history usage on tables (14/30/60-day windows). Disabled by default. See Redshift Usage Data.
Extract Column Usage	Collect read usage on columns. Requires Extract Usage Metrics. Disabled by default.
Observe external tables	Discover Spectrum external tables. Enabled by default.
Cost per RPU-hour / node-hour (USD)	Optional compute rates used to estimate query cost.
Storage cost per GB (USD)	Optional monthly storage rate used to estimate storage cost.
Schema Pattern	Regular expressions to include or exclude schemas. System schemas are always excluded.
Local Agent	Select a local agent to route traffic when the cluster or workgroup is inside a private network. See Local Agents.

Credentials from a local agent: when a local agent is selected, the database password can be fetched from your own secret store at connection time instead of being stored in Euno — pick a handle in the from agent dropdowns under Advanced. See Local Agents — secret handles.

Step 8: Save Configuration

Click Test & Save to validate the connection and permissions before saving.

Discovered Resources

For detailed information about discovered resources, properties, relationships, and URI patterns, see Redshift Integration Discovered Resources.