Redshift Access Pattern
Audience: System Administrators
Content Summary: This page describes the Native Redshift access pattern, through which Immuta applies policies directly in Redshift.
For installation instructions, see Add a Native Integration.
With the Native Redshift access pattern, Immuta applies policies directly in Redshift. This allows data analysts to query their data natively with Redshift views instead of going through the Immuta Query Engine and have per-user policies dynamically applied at query time. Users can configure multiple native Redshift integrations in a single instance of Immuta.
Syncing and Policy Enforcement
The Redshift access pattern uses webhooks to keep views up-to-date with Immuta data sources. When a data source or policy is created, updated, or disabled, a webhook will be called that will create, modify, or delete the dynamic view.
SQL statements are used to create all views, including a join to the secure view:
This secure view is a
immuta_system.profile table (which contains all Immuta users and their current groups, attributes, projects,
and a list of valid tables they have access to) with a constraint
immuta__userid = current_user() to ensure it only
contains the profile row for the current user. The
immuta_system.user_profile view is readable by all users, but
will only display the
data that corresponds to the user executing the query.
immuta_system.profile table is updated through webhooks when a user's groups or attributes change,
they switch projects, they acknowledge a purpose, or when their data source access is approved or revoked.
The profile table can only be read and updated by the Immuta system account.
The native integration will create views from the tables within the database specified when configured. Then, the
user can choose the name for the schema where all the Immuta generated views will reside. Immuta will also create
immuta_procedures to contain the tables, views, UDFs, and
stored procedures that support the native integration.
- The host of the data source must match the host of the native connection for the native view to be created.
- Redshift with Immuta must be an RA3 instance type to support the necessary cross database joins.
- When using multiple Redshifts, a user will have to have the same user account across all hosts.