# Amazon Redshift Reverse ETL Source


[Amazon Redshift](https://aws.amazon.com/redshift/) is one of the fastest cloud data warehouse services. It lets you handle large analytical workloads with best-in-class performance, speed, and efficiency.

RudderStack supports Amazon Redshift as a data source from which you can ingest data and route it to your desired downstream destinations.

## Grant permissions {#granting-permissions}

Before you set up Redshift as a source, you must grant certain permissions on your Redshift warehouse for RudderStack to access data from it.

Run the queries listed in the following sections in the  **exact order** to grant the required permissions:

### Step 1: Create new user in Redshift {#step-1-creating-a-new-user-in-redshift}

1. Create a new user `rudder` with a password `<strong_unique_password>`.

```sql
CREATE USER rudder WITH PASSWORD '<strong_unique_password>'
```

The password set in the above command must meet the following conditions:

* It should be **8-64** characters in length.
* It must contain at least one upper case, one lower case, and one number.
* It can contain any ASCII characters with the ASCII codes 33-126, with the exception of `'` (single quotation mark), `"` (double quotation mark), `\`, `/`, and `@`.

See the [Amazon Redshift documentation](https://docs.aws.amazon.com/redshift/latest/dg/r_CREATE_USER.html#r_CREATE_USER-parameters) for more information on the password rules.

### Step 2: Create RudderStack schema and grant permissions {#creating-the-rudderstack-schema-and-granting-permissions}

1. Create a dedicated schema `_rudderstack`.

```sql
CREATE SCHEMA "_rudderstack";
```

{{< warning >}}
The `_rudderstack` schema stores Reverse ETL sync state, snapshots, and related tables. **Do not change this name**.

See [`_rudderstack` Schema Reference]({{< ref "data-pipelines/reverse-etl/developer-guides/rudderstack-schema.md" >}}) for more details.
{{< /warning >}}

2. Grant full access to schema `_rudderstack` for the user `rudder`.

```sql
GRANT ALL ON SCHEMA "_rudderstack" TO rudder;
```

3. Grant full access to the user `rudder` over all `_rudderstack` schema objects.

```sql
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA "_rudderstack" TO rudder;
```

### Step 3: Grant permissions on schema and table {#step-3-granting-permissions-on-your-schema-and-table}

1. Grant access to the user `rudder` to look up the objects within your schema:

```sql
GRANT USAGE ON SCHEMA "<YOUR_SCHEMA>" TO rudder;
```

2. Grant access to the user `rudder` to read data from the required table/view:

```sql
GRANT SELECT ON TABLE "<YOUR_SCHEMA>"."<YOUR_TABLE>" TO rudder;
```

Replace `<YOUR_SCHEMA>` and `<YOUR_TABLE>` with the exact names of your Redshift schema and table respectively.

#### **Optional commands**

* The following command grants access to the user `rudder` to view and read data from **all** the tables present in the schema `<YOUR_SCHEMA>`:

```sql
GRANT SELECT ON ALL TABLES IN SCHEMA "<YOUR_SCHEMA>" TO rudder;
```

{{< warning >}}
Run this command only if you're okay with RudderStack being able to access the data in all tables residing within your specified schema.
{{< /warning >}}

* The following command grants access to the user `rudder` to read data from all future tables created by the user `creator` in your schema:
 
```sql
ALTER DEFAULT PRIVILEGES for user creator IN SCHEMA "<YOUR_SCHEMA>" GRANT SELECT ON TABLES TO rudder;
```

{{< warning >}}
Run this command only if you're okay with RudderStack being able to access the data in all future tables residing within your specified schema.
{{< /warning >}}

Replace `<YOUR_SCHEMA>` with the exact name of your Redshift schema.

## Set up Redshift source in RudderStack {#setting-up-the-redshift-source-in-rudderstack}

1. Log in to your [RudderStack dashboard](https://app.rudderstack.com/).
2. On the **Connections** page, click **Add source**.
3. Under **Sources**, click **Reverse ETL** and select **Redshift**.

### Configure warehouse credentials {#configuring-the-connection-credentials}

You can choose to proceed with your existing warehouse credentials if you have configured them in the RudderStack dashboard previously. Otherwise, click **Add new credentials** to add new credentials for your warehouse.

- **Host**: Enter the host name of your Redshift service.
- **Port**: Enter the port number associated with the Redshift database instance.
- **Database**: Enter the database name of your Redshift instance from where RudderStack ingests the data.
- **User**: Enter the name of the Redshift user created while [granting permissions](#step-1-creating-a-new-user-in-redshift).
- **Authentication Type**: Select the authentication mechanism from the dropdown. RudderStack provides the below authentication mechanisms:
    - **IAM** (recommended): Lets you use the RudderStack IAM role for authentication. For more information on creating a RudderStack IAM role for Redshift, see [this guide]({{< ref "destinations/aws-iam-role-for-rudderstack/redshift-iam-role.md" >}}).
    - **Username Password Authentication**: Lets you use the username and password for authenticating to Redshift.

You will see the following settings depending on the authentication type you select:

{{< tabs tabTotal="2" >}}
{{% tab tabName="IAM" %}}
- **Cluster identifier**: Enter your AWS cluster ID.
- **Cluster region**: Enter your AWS cluster region.
{{% /tab %}}
{{% tab tabName="Username Password Authentication" %}}
- **Password**: Enter the password for the user specified in the **User** field above.
{{% /tab %}}
{{< /tabs >}}

Then, continue with the setup by specifying the below setting:

- **SSL Mode**: Select the SSL mode as **disable** or **require** depending on how RudderStack should connect to your Redshift instance.

Click the **Verify** button on the top right. RudderStack will then [verify and validate your credentials](#faq). Once verified, click **Continue** to proceed.

### Specify name and source type

{{< customreadfile "/includes/retl/retl-name-sourcetype.md" >}}

#### **Use warehouse table as source**

{{< customreadfile "/includes/retl/table-as-source.md" >}}

#### **Use model as source**

{{< customreadfile "/includes/retl/model-as-source.md" >}}

#### **Use audience as source**

{{< customreadfile "/includes/retl/audience-as-source.md" >}}

### Review and complete setup

{{< customreadfile "/includes/retl/review-retl-setup.md" >}}

## Connect destination

{{< customreadfile "/includes/retl/connect-retl-destination.md" >}}

## Update source configuration and settings

{{< customreadfile "/includes/retl/update-retl-source-configuration.md" >}}

## FAQ

#### What are the SSL mode options when setting up the Redshift source in RudderStack?

When setting up a Redshift source, RudderStack provides the following two SSL options:

- **disable**: SSL mode is disabled when you select this option. Use it in cases where security is not an issue and you don't want any encryption overhead.
- **require**: When you select this option, your data is encrypted and sent to RudderStack. Use it in cases where security is important and you can deal with the resulting encryption overhead.

{{< customreadfile "/includes/retl/retl-faq.md" >}}