Skip to main content
Log in
Cust Docs

Amazon Redshift

Connect Redshift through the Data API and schedule queries into Cust.

Cust supports provisioned Redshift clusters and Redshift Serverless workgroups. Admins and Owners connect the warehouse in Settings → Integrations → Redshift.

Prepare access

The setup wizard walks through a read-only database user, an AWS Secrets Manager secret, and an IAM user. You need permission to create each of these in AWS.

  1. Open Redshift and start the connection wizard.
  2. In Database user, use the SQL shown to create a read-only user. Replace the password and schema placeholders, and repeat the grants for each schema you want to query.
  3. Select the deployment type, cluster identifier or Serverless workgroup name, and database.
  4. In Secret, store the database credentials in Secrets Manager in the warehouse's region. Paste the secret's full ARN into Cust.
  5. In IAM user, follow the console instructions or generated CloudShell script to create the user and access key.
  6. In Connect, enter the access key ID, secret access key, region, warehouse details, database, and secret ARN. Click Connect.

If these resources already exist, use Skip to connect and enter their details directly.

Permissions

The generated IAM policy allows the Redshift Data API to execute, describe, retrieve, and cancel queries. It also grants secretsmanager:GetSecretValue for the specific database secret. Database grants control which schemas and tables the read-only user can query.

Use the instructions generated in the wizard so the policy refers to your secret. The AWS access key is stored encrypted by Cust; the database password remains in Secrets Manager.

Create and verify a sync

After connecting, click New sync and follow Data syncs to choose a destination, enter SQL, preview rows, match records, and set a schedule.

The connection test runs SELECT 1. A successful connection confirms the Data API credentials, while a preview of your actual query confirms the table access and result columns.

If the connection test times out, a paused cluster or idle Serverless workgroup may still be starting. Wait a minute and retry. For an access error, check the IAM policy, secret ARN, region, and database user's grants.