---
schema_version: "1"
id: 09a00e33825a710453e0dd96fd42454548918fb3f9dcc0643cfaa1bc8de3ca3c
title: Use Identity Provider Authentication for Amazon Redshift Data Federation Connection
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/data-cloud/data-cloud-int/guides/redshift/c360-a-idp-data-federation-redshift-connection.md
canonical_url: https://developer.salesforce.com/docs/data/data-cloud-int/guide/c360-a-idp-data-federation-redshift-connection.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 18f8ed48f0f6f4b104bb7dd2eadd60cff6be6f48cf1019fe7cca5d73d69ba98a
products:
  - Data 360 Integration Guide
  - Data 360 Developer Documentation
---
# Use Identity Provider Authentication for Amazon Redshift Data Federation Connection

Add an identity provider (IdP) and create the necessary policies in AWS to use IdP-based authentication when connecting to a Redshift database using Amazon Redshift Data Federation Connection.

| User Permissions Needed                                          |                                                             |
| ---------------------------------------------------------------- | ----------------------------------------------------------- |
| To create an Amazon Redshift Federation connection in Data Cloud | System Admin profile or Data Cloud Architect permission set |

Before you begin be sure to set up your connection and get the generated External Id.

1.  Add an identity provider for Salesforce in AWS.

    1.  In the navigation pane of IAM, choose **Identity providers**, and then choose **Add provider**.

    2.  For **Configure provider**, choose **OpenID Connect**.

    3.  Enter the My Domain URL details for the provider URL and audience.

        | IdP Details in AWS Management Console | URL Format                          | Example                                                                                    |
        | ------------------------------------- | ----------------------------------- | ------------------------------------------------------------------------------------------ |
        | Provider URL                          | _My Domain URL_/services/connectors | https://dlt0000007luz2am-dev-ed.develop.test1.my.pc-rnd.salesforce.com/services/connectors |
        | Audience                              | _My Domain URL_                     | https://dlt0000007luz2am-dev-ed.develop.test1.my.pc-rnd.salesforce.com                     |

        **tip:** To find the My Domain URL of your org, go to Setup, click Settings, and then Company Settings. Click My Domain to find your Current My Domain URL. For more information, see [My Domain](https://help.salesforce.com/s/articleView?id=domain_name_overview.htm).

    4.  Verify the information you provided and choose **Add provider**.

        IAM attempts to retrieve and use the top intermediate CA thumbprint of the OIDC IdP server certificate to create the IAM OIDC identity provider.

2.  Create the necessary roles in AWS for the Data Cloud Redshift connector to connect to Redshift. See [Creating a role using custom trust policies (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-custom.html).

3.  Associate a permission policy to the role.

    Sample permission policy for Redshift Cluster.

    ```nolang
    {
    "Sid": "AllowGetCredentialsRedshift",
    "Effect": "Allow",
    "Action": [
    "redshift:GetClusterCredentialsWithIAM"
    ],
    "Resource": [
    "arn:aws:redshift:us-west-2:211125688834:dbname:redshift-cluster-idp-poc/dev"
    ]
    }

    ```

    Sample permission policy for Redshift Workgroup (Serverless)

    ```nolang
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Sid": "AllowGetCredentialsRedshiftServerless",
    "Effect": "Allow",
    "Action": [
    "redshift-serverless:GetCredentials"
    ],
    "Resource": [
    "arn:aws:redshift-serverless:us-west-2:211125688834:workgroup/33f34cd9-7b0a-4bfc-b5ae-7d03da8038cd"
    ]
    }
    ]
    }

    ```

4.  Associate a trust policy to the role using the External ID obtained when you set up the connection.

    Sample trust policy

    ```nolang
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Principal": {
    "Federated": "arn:aws:iam::211125688834:oidc-provider/orgfarmout-2d4.test1.my.pc-rnd.salesforce.com/services/connectors"
    },
    "Action": "sts:AssumeRoleWithWebIdentity",
    "Condition": {
    "StringEquals": {
    "orgfarmout-2d4.test1.my.pc-rnd.salesforce.com/services/connectors:sub": "app:DE809C7E:EF92A163"
    }
    }
    }
    ]
    }

    ```

5.  Get the Amazon Resource Name (ARN) of the role and use it as the IAM Role Name when setting up Amazon Redshift Data Federation Connection.

6.  If you are setting up a role for Redshift Workgroup (serverless), make sure your role is part of the pg_user list.

    To check if your role is part of the list, run ‌the command `select * from pg_user;`. If the role is'nt part of the list, run the command, `create user IAMR:<username> password DISABLE;` and create the db user with the same role name.

7.  If you’re setting up a role for Redshift Workgroup (serverless), grant read permissions on the schema with these statements.

    ```nolang
    ​​GRANT USAGE ON SCHEMA idp_test TO "IAMR:<ROLE NAME>";
    GRANT SELECT ON ALL TABLES IN SCHEMA idp_test TO "IAMR: <ROLE NAME>";
    ```

**note:** If Redshift and Data 360 are in different regions, ensure to update the region details in the Redshift AWS Region field.
You can also choose to create a new connection or edit an existing connection to use the Identity Provider based authentication method.