Skip to content

You are viewing documentation for Immuta version 2022.5.

For the latest version, view our documentation for Immuta SaaS or the latest self-hosted version.

cancel

Configure Redshift Integration

This page illustrates how to configure the Redshift integration in Immuta. For an overview of the integration, see the Redshift Overview documentation.

For instructions on configuring Redshift Spectrum, see the Redshift Spectrum section.

Redshift Multi-Database Integration

Prerequisites

  • A Redshift cluster with an RA3 node is required for the multi-database integration. You must use a Redshift RA3 instance type because Immuta requires cross-database views, which are only supported in Redshift RA3 instance types. For other instance types, you may configure a single-database integration using one of the Redshift Spectrum tutorials below.
  • For automated installations, the credentials provided must be a Superuser or have the ability to create databases and users and modify grants.
  • The enable_case_sensitive_identifier parameter must be set to false (default setting) for your Redshift cluster.

Add the Integration

  1. Click the App Settings icon in the left sidebar.
  2. Click Native Integrations in the left panel.
  3. Click the +Add Native Integration button and select Redshift from the dropdown menu.
  4. Complete the Host and Port fields.

  5. Enter an Immuta Database. This is a new database where all secure schemas and Immuta created views will be stored.

    Redshift Config Modal

  6. Opt to check the Enable Impersonation box and customize the Impersonation Role name as needed. This will allow users to natively impersonate another user.

  7. Set up the connection Automatically or Manually.

    Immuta requires temporary, one-time use of credentials with specific privileges.

    When performing an automated installation, Immuta requires temporary, one-time use of credentials with the following privileges:

    • CREATE DATABASE
    • CREATE USER
    • REVOKE ALL PRIVILEGES ON DATABASE
    • GRANT TEMP ON DATABASE
    • MANAGE GRANTS ON ACCOUNT

    These privileges will be used to create and configure a new IMMUTA database within the specified Redshift instance. The credentials are not stored or saved by Immuta, and Immuta doesn’t retain access to them after initial setup is complete.

    You can create a new account for Immuta to use that has these privileges, or you can grant temporary use of a pre-existing account. By default, the pre-existing account with appropriate privileges is a Superuser. If you create a new account, it can be deleted after initial setup is complete.

    Alternatively, you can create the IMMUTA database within the specified Redshift instance manually using the Manual Setup option.

    1. Select Automatic.
    2. Enter an Initial Database from your Redshift integration for Immuta to use to connect.

    3. Use the dropdown menu to select your Authentication Method.

      1. Username and Password: Enter the Username and Password of the privileged user.
      2. AWS Access Key: Enter the Database User, Access Key ID, and Secret Key. Opt to enter in the Session Token.

    Required Privileges

    The specified role used to run the bootstrap needs to have the following privileges:

    • CREATE DATABASE
    • CREATE USER
    • REVOKE ALL PRIVILEGES ON DATABASE
    • GRANT TEMP ON DATABASE
    • MANAGE GRANTS ON ACCOUNT
    1. Select Manual and download both of the bootstrap scripts.
    2. Run the bootstrap script (initial database) in the Redshift initial database.
    3. Run the bootstrap script (Immuta database) in the new Immuta Database in Redshift.
    4. Choose your authentication method, and enter the information of the newly created account.

  8. Click Test Redshift Connection.

  9. Once the credentials are successfully tested, click Save.

  10. Click Confirm.

Redshift Spectrum

Allow Immuta to create secure views of your external tables through one of these methods:

For an overview of the integration, see the Redshift Overview documentation.

Prerequisites

Use an Existing Database

  1. Click the App Settings icon in the left sidebar.
  2. Click Native Integrations in the left panel.
  3. Click the +Add Native Integration button and select Redshift from the dropdown menu.
  4. Complete the Host and Port fields.

  5. Enter the name of the database you created the external schema in as the Immuta Database. This database will store all secure schemas and Immuta-created views.

    Redshift Config Modal

  6. Opt to check the Enable Impersonation box and customize the Impersonation Role name as needed. This will allow users to natively impersonate another user.

  7. Select Manual and download both of the bootstrap scripts. The specified role used to run the bootstrap needs to have the following privileges:

    • ALL PRIVILEGES ON DATABASE for the database you configure the integration with, as you must manage grants on that database.
    • CREATE USER
    • GRANT TEMP ON DATABASE

  8. Run the bootstrap script (Immuta database) in the Redshift database that contains the external schema.

  9. Choose your authentication method, and enter the credentials from the bootstrap script for the Immuta_System_Account.

  10. Click Test Redshift Connection.

  11. Once the credentials are successfully tested, click Save and Confirm.

Create a New Immuta Database

  1. Click the App Settings icon in the left sidebar.
  2. Click Native Integrations in the left panel.
  3. Click the +Add Native Integration button and select Redshift from the dropdown menu.
  4. Complete the Host and Port fields.

  5. Enter an Immuta Database. This is a new database where all secure schemas and Immuta created views will be stored.

    Redshift Config Modal

  6. Opt to check the Enable Impersonation box and customize the Impersonation Role name as needed. This will allow users to natively impersonate another user.

  7. Select Manual and download both of the bootstrap scripts. The specified role used to run the bootstrap needs to have the following privileges:

    • ALL PRIVILEGES ON DATABASE for the database you configure the integration with, as you must manage grants on that database.
    • CREATE DATABASE
    • CREATE USER
    • GRANT TEMP ON DATABASE

  8. Run the bootstrap script (initial database) in the Redshift initial database.

  9. Run the bootstrap script (Immuta database) in the new Immuta Database in Redshift.
  10. Choose your authentication method, and enter the credentials from the bootstrap script for the Immuta_System_Account.
  11. Click Test Redshift Connection.
  12. Once the credentials are successfully tested, click Save and Confirm.

Then, add your external tables to the Immuta database.

Edit a Redshift Integration

  1. Click the App Settings icon in the left sidebar.
  2. Navigate to the Native Integrations section and click the down arrow next to the Redshift Integration.
  3. Edit the field you want to change. Note any field shadowed is not editable, and the integration must be disabled and re-installed to change it.

  4. Enter Username and Password.

    Immuta requires temporary, one-time use of credentials with specific permissions.

    When performing edits to an integration, Immuta requires temporary, one-time use of credentials of a Superuser or a user with the following permissions:

    • Create Databases
    • Create users
    • Modify grants

    Alternatively, you can download the Edit Script and run it in Redshift.

  5. Click Validate Credentials.

  6. Click Save.
  7. Click Confirm.

Remove a Redshift Integration

Redshift Spectrum

Disabling the Redshift integration is not supported when you set the fields nativeWorkspaceName, nativeViewName, and nativeSchemaName to create Redshift Spectrum data sources. Disabling the integration when these fields are used in metadata ingestion causes undefined behavior.

  1. Click the App Settings icon in the left sidebar.
  2. Navigate to the Native Integrations section and click the down arrow next to the Redshift Integration.
  3. Click the checkbox to disable the integration.
  4. Enter the username and password that were used to initially configure the integration and click Validate Credentials.
  5. Click Save.
  6. Click Confirm.