Connect to Redshift

Support for Redshift Serverless is public beta. Support for Redshift clusters is generally available.

This documentation describes one or more public beta features that are in development. Beta features are subject to quick, iterative changes; therefore the current user experience in the Sigma service can differ from the information provided in this page.

This page should not be considered official published documentation until Sigma removes this notice and the beta flag on the corresponding feature(s) in the Sigma service. For the full beta feature disclaimer, see Beta features.

Sigma supports secure connections to Amazon Redshift. This document explains how to connect your organization to an Amazon Redshift warehouse.

For information about Sigma feature compatibility with Amazon Redshift connections, see Region, warehouse, and feature support.

Requirements

In your Sigma organization:

You must be assigned the Admin account type or an account type with the Manage connections permission enabled.

In AWS:

You must have access to an Amazon Redshift data warehouse with a configured cluster or a Redshift Serverless workgroup (Beta).

Limitations

Redshift Serverless connections are read-only and in public beta. Features that require write access, such as using input tables, uploading CSV files, or materialization, are not supported.
If you plan to use input tables on this connection, a cluster node size of ra3.4xlarge or rg.4xlarge or larger is recommended.
Objects from Redshift datashares do not appear in the connection browser directly, but can be queried using the custom SQL element. To make them available in the connection browser, query the object in a data model using the format select * from <table>. The data model with the datashare contents is then available to select as a data source.

Configure Amazon Redshift

Before you connect your Sigma organization to Amazon Redshift, complete the following steps in the AWS Management Console for your Amazon Redshift cluster or Amazon Redshift Serverless workgroup (Beta).

Configure Amazon Redshift cluster

Modify your Amazon Redshift cluster or Serverless workgroup to be publicly accessible and assign an Elastic IP address to connect to it. For details, see Configuring security group communication settings for an Amazon Redshift cluster or an Amazon Redshift Serverless workgroup in the Amazon Redshift Management Guide.
Create a security group, then add the Sigma IP addresses to the inbound and outbound rules of the security group. Obtain the IP addresses from the connection configuration page in the Sigma UI. See Add Sigma IPs to the allowlist.
Attach the security group to your Amazon Redshift cluster or Amazon Redshift Serverless workgroup.
Create an Amazon Redshift user to act as the service account for connection to your Sigma organization.

Grant this user USAGE privileges on all relevant schemas in the Redshift database and SELECT grants on all relevant tables within those schemas. Configure this user to have the same privileges on any additional tables that might be added to the schema.

For documentation on granting privileges, see GRANT in the Amazon Redshift Database Developer Guide.

Example SQL statement:
```
CREATE USER your_sigma_service_account_name password 'a_secure_password'; 
GRANT USAGE ON SCHEMA your_schema_name TO your_sigma_service_account_name;
GRANT SELECT ON ALL TABLES IN SCHEMA your_schema_name TO your_sigma_service_account_name;
ALTER DEFAULT PRIVILEGES IN SCHEMA your_schema_name
GRANT SELECT ON TABLES TO your_sigma_service_account_name;
```
(Optional) If you want to run stored procedure actions, grant the service account user USAGE on any schema that contains stored procedures that you want to run from Sigma, and grant EXECUTE privileges on all or specific stored procedures.

Example SQL statement:
```
GRANT USAGE ON SCHEMA your_sproc_schema_name TO your_sigma_service_account_name;
GRANT EXECUTE ON ALL PROCEDURES IN SCHEMA your_sproc_schema_name TO your_sigma_service_account_name;
```
(Optional, Amazon Redshift cluster only) If you want to use write access features such as CSV upload, materialization, input tables, and warehouse views, create a dedicated schema that Sigma can write data to.

Grant CREATE privileges on that schema to the service account user, and grant SELECT, INSERT, UPDATE, DELETE on all tables in that schema. Configure the user to have the same privileges on any additional tables that might be added to the schema.
```
GRANT USAGE, CREATE ON SCHEMA your_write_schema_name TO your_sigma_service_account_name;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA your_write_schema_name TO your_sigma_service_account_name;
ALTER DEFAULT PRIVILEGES IN SCHEMA your_write_schema_name
GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO your_sigma_service_account_name;
```
Retrieve the relevant connection details for your Amazon Redshift cluster or Amazon Redshift Serverless workgroup from the console. For example, retrieve the cluster endpoint and port for your cluster, or the Amazon Redshift Serverless workgroup connection string and port.

Next, Create an Amazon Redshift connection in Sigma.

Create an Amazon Redshift connection in Sigma

To create an Amazon Redshift connection, perform the following steps in the Sigma UI:

Add a connection and specify connection details

Click the user icon at the top right of your screen.

The user icon is usually composed of your initials.
In the drop-down menu, select Add connection. The Add new connection page appears.
In the Connection details section, specify the following:

Name Enter a Name for the new connection.
Type Select Redshift.


Name	Enter a Name for the new connection.
Type	Select Redshift.

Specify your connection credentials

In the Connection credentials section, fill out the required fields:

In the Host field, provide the relevant details:
- For a Redshift cluster, provide the endpoint for your cluster. For example, cluster.abcd.us-west-1.redshift.amazonaws.com. To retrieve the cluster endpoint, visit the General Information screen for your Redshift cluster, or see Finding your cluster connection string in the Amazon Redshift documentation.
- For Redshift Serverless (Beta), provide the connection string. For example, default.123456789012.us-west-2.redshift-serverless.amazonaws.com. For details, see Connecting to Amazon Redshift Serverless in the Amazon Redshift documentation.
In the Port field, enter the port number. The default port is 5439 for both Redshift clusters and Redshift Serverless (Beta). If your cluster or workgroup uses a different port, locate the port number in the properties of your Amazon Redshift cluster under Database configurations.
In the User field, enter the username of the Amazon Redshift user you created to connect to your Sigma organization. See Step 4 in Configure Amazon Redshift.
In the Password field, manually enter the password or select a secret from your organization’s secret manager integration:
- Manually enter the password: Enter the password of the Amazon Redshift user you created to connect to your Sigma organization.
- Use existing secret: Turn on the Use secret manager toggle, then select your desired Secret manager and Secret.
In the Database field, enter the Redshift database name to connect to. For example, dev.
(Optional) Turn on the Enable TLS toggle to enable TLS encryption on your connection.
(Optional) Turn on the SSH Tunnel toggle to connect through SSH, then enter the Tunnel host and Tunnel port. See Connect through SSH.

Next, see Configure write access if using a Redshift cluster, and Configure connection features for additional options. Or, if you are finished configuring your connection, click Create to create your connection.

Configure write access

Write access is necessary for the following features:

Configuring write access requires you to set up a dedicated schema in Amazon Redshift that Sigma can use to write data and grant the necessary privileges on that schema to the service account. See Step 6 in Configure Amazon Redshift. Write access is not supported for connections to Redshift Serverless (Beta).

When you designate a schema as the write access destination, Sigma reserves it for internal write-back objects and doesn’t expose it as a data source in the connection explorer (data catalog). To avoid restricting user access to analytical data, use a dedicated write-back database or schema that doesn’t store data used for analysis and reports.

To allow write access on this connection, turn on the Enable write access toggle.
In the Write schema field, enter the name of the dedicated schema you created for Sigma to store write-back data.

Next, see Configure connection features for additional options. Or, if you are finished configuring your connection, click Create to create your connection.

Configure connection features

In the Connection features section, specify the following:

In the Connection timeout field, specify the amount of time, in seconds, that Sigma waits for the query to return results before timing out. The default is 120 seconds. The maximum is 600 seconds (10 minutes).
(Optional) If you do not want Sigma to automatically make column names from the data source more readable, turn off the Use friendly names toggle. For example, with Use friendly names turned on, a database column ORDER_NUMBER or OrderNumber appears as Order Number.

Finish creating your connection

After you specify all the parameters of the connection, click Create. Sigma displays a connection summary.
Click Browse Connection, then click Add permission to grant connection access for users in your organization. See Data permissions.
Use the navigation in the left panel to explore the schemas and tables in your connection.

Connect through SSH