M↓ View as Markdown ↗

Amazon Redshift

Connect an Amazon Redshift cluster to Actian AI Analyst so you can build Models on its tables and let your AI Analysts query them.

Availability

• Who can do this: members with the Edit capability in the active Workspace. If your organization turns on Restrict connection management, you also need the Manage organization capability.
• Plan: available unless your organization's plan excludes the Amazon Redshift connector.
• Deployment: Actian SaaS and self-managed deployments, unless the deployment's operator has turned the Amazon Redshift connector off.

Read-only access

AI Analyst runs the queries it sends against your data inside a read-only transaction, so Redshift itself refuses writes. Still, give AI Analyst a user that can only read the data you want to analyze. See Read-only access.

1. Create a read-only user in Redshift

Use an admin account to create a technical user for AI Analyst. Replace the placeholders (<your_strong_password>, public) with your own values.

-- Create the user
CREATE USER analyst_user PASSWORD '<your_strong_password>';

-- Grant read-only access to the schema
GRANT USAGE ON SCHEMA public TO analyst_user;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO analyst_user;

-- Grant access to future tables and views
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO analyst_user;

Repeat the GRANT and ALTER DEFAULT PRIVILEGES statements for each schema you want to expose. In Redshift, ALL TABLES and ON TABLES also cover views.

Tip

• Use a dedicated database and schema for analytics or reporting if possible.
• Only grant access to the data AI Analyst should analyze.
• ALTER DEFAULT PRIVILEGES applies to objects created later by the user who runs it. Run it as the user who creates your tables, or add FOR USER <owner>.

2. Allow network access

If your cluster's VPC security group restricts inbound traffic, allow the IP addresses that AI Analyst connects from on your Redshift port (default 5439):

• Actian SaaS: when your deployment publishes its addresses, the Setup help panel next to the connection form lists them under Which IPs to allow.
• Self-managed deployment: AI Analyst connects from your own installation's network. Allow its outbound addresses, or ask whoever operates your installation.

If no addresses are listed, or you allowed an address from an earlier version of these docs, see Network access.

To add an inbound rule in AWS:

1. In the AWS console, go to Redshift → Clusters and open your cluster.
2. Under Network and security, open the cluster's VPC security group.
3. On the Inbound rules tab, click Edit inbound rules.
4. Add a rule:
   • Type: Redshift (or Custom TCP)
   • Port: 5439 (or your configured port)
   • Source: each AI Analyst egress address
5. Save the rule.

Note

Your cluster must be reachable from AI Analyst. If the host is a private network address, Studio shows This looks like a local address. You can still save the connection, but AI Analyst can only connect if its servers can reach that network, for example through a VPN, peering or an allowlist. See Network access.

3. Set up the connection in AI Analyst

1. In Studio, open Connections and click the plus button (Add connection).
2. Under Warehouses, select Amazon Redshift.
3. Under Connection details, enter a Name and, optionally, a Description. Select Private to this Workspace if only the current Workspace should use the connection. See Connections and Workspaces.
4. Under Credentials, fill in:
   • Host: your cluster endpoint without protocol, such as your-cluster.region.redshift.amazonaws.com.
   • Port: 5439 by default.
   • Database: the database to connect to.
   • Username: analyst_user.
   • Password: the password you set.
   • SSL mode: Require by default. See SSL mode.
5. Click Test connection.
6. When the test succeeds, select the Schemas to expose for browsing and model authoring. public is preselected.
7. Click Save connection.

Note

• Save connection stays unavailable until the test passes. A successful test is valid for five minutes, and changing a connection field resets it. If either happens, test again.
• The password is encrypted at rest and never shown again after you save.

Paste a connection string

Instead of typing each field, you can click Paste a connection string, paste a JDBC URL, and click Fill the form. For example:

jdbc:redshift://your-cluster.region.redshift.amazonaws.com:5439/database

AI Analyst fills Host, Port and Database, plus the username, password and SSL mode if the string includes them. Nothing is sent until you test the connection.

SSL mode

Option	Behavior
Disable	No encryption.
Require (default)	Encrypts the connection and verifies the server certificate.
Require (no verify)	Encrypts the connection without verifying the server certificate.
Verify CA	Behaves like Require (no verify): encrypted, without certificate verification.
Verify full	Encrypts the connection and verifies the server certificate.

Keep Require unless you have a reason to change it.

Troubleshooting

When a test fails, the form shows a short summary, such as Authentication failed, Could not reach the warehouse or Could not establish a secure connection. Expand it to see the error that Redshift returned.

Symptom	Likely cause	What to do
Could not reach the warehouse	The security group blocks AI Analyst, the cluster is not publicly accessible, or the host or port is wrong.	Review step 2 and check Host and Port.
Authentication failed	Wrong username or password.	Check the credentials, or reset the user's password.
Could not establish a secure connection	The SSL settings do not match the cluster's.	Keep SSL mode on Require. Use Require (no verify) only to diagnose the problem, because it does not check the server certificate.
A schema is missing from Schemas	The user has no USAGE on that schema.	Grant USAGE and SELECT as in step 1, then test again.

For connections that already exist, see Manage connections and Data source health monitoring.

Next steps

Create Models on the tables you want to analyze (see Creating models) and add them to an AI Analyst (see Models).