How to configure an AWS IAM Role for using IAM authentication with Redshift Serverless

Follow the steps described in this document in order to get a working AWS IAM Role for creating a Redshift integration with IAM authentication enabled.

1- Create the AWS Policy

In the AWS console, go to IAM -> Policies, click on Create policy.

The policy must have at least one grant: redshift-serverless:GetCredentials on the Resource corresponding to your Redshift Serverless workgroup.

Optionally, if you are using AWS Lake Formation to manage the permissions to access your data, you can grant this policy the appropriate permissions so that everything you want to monitor with Sifflet can be read.

2- Create the role with a custom trust policy

Please find the main steps below (you can also refer to AWS's official documentation):

• In the AWS console, go to IAM -> Roles, click on Create role
• Choose Custom trust policy and copy the following JSON.
  Do not forget to replace AWS Role ARN with the correct value for your instance, that you will get in Sifflet, by going to Settings and then Integration Preferences.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "<AWS Role ARN>"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

• On the next screen, choose the previously created policy.
• On the next screen, you can choose the name of the role, for instance, sifflet_redshift_read_role
• You can now access your newly created role. Please take note of its ARN, you will need it to connect Sifflet to Redshift. It will be similar to the following arn:aws:iam::123456789101:role/sifflet_redshift_read_role