> For the complete documentation index, see [llms.txt](https://documentation.immuta.com/SaaS/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.immuta.com/SaaS/configuration/integrations/redshift/amazon-redshift-integration/register-an-amazon-redshift-connection.md).

# Register an Amazon Redshift Connection

Register your Amazon Redshift data and map your user accounts into Immuta

## Permissions

The user registering the connection must have the permissions below.

* `APPLICATION_ADMIN` Immuta permission
* The Amazon Redshift user registering the connection must be a superuser or have the following Amazon Redshift privileges:

  * `CREATEDB`
  * `CREATE USER`
  * `sys:secadmin` role
  * `USAGE` on all databases and schemas that contain data you want to register
  * The following privileges `WITH GRANT OPTION` on objects registered in Immuta:
    * `DELETE`
    * `INSERT`
    * `SELECT`
    * `TRUNCATE`
    * `UPDATE`

  For descriptions and explanations of privileges Immuta needs to enforce policies and maintain state in Amazon Redshift, see the [Amazon Redshift integration reference guide](/SaaS/configuration/integrations/redshift/amazon-redshift-integration/reference-guides/amazon-redshift-integration-reference-guide.md#required-amazon-redshift-privileges).

## Prerequisites

Enable Amazon Redshift masking on data objects Immuta will protect using the `ALTER TABLE` command with the `MASKING ON` clause.

See the [Amazon Redshift documentation](https://docs.aws.amazon.com/redshift/latest/dg/r_ALTER_TABLE.html) for details.

## Create the database user

1. [Create a new database user in Redshift to serve as the Immuta system account](https://docs.aws.amazon.com/redshift/latest/dg/r_CREATE_USER.html). Immuta will use this system account continuously to crawl the connection.
2. [Grant this account the following Redshift privileges](https://docs.aws.amazon.com/redshift/latest/dg/r_GRANT.html):
   * `USAGE` on all databases and schemas that contain data you want to register
   * `CREATE ROLE`
   * `sys:secadmin` role
   * The following privileges `WITH GRANT OPTION` on objects registered in Immuta:
     * `DELETE`
     * `INSERT`
     * `SELECT`
     * `TRUNCATE`
     * `UPDATE`

## [Create the exemption role](/SaaS/configuration/integrations/redshift/amazon-redshift-integration/reference-guides/amazon-redshift-integration-reference-guide.md#policy-exemption-role)

1. Create a new role in Amazon Redshift called `immuta_exemption`.
2. Grant any users who should be exempt from Immuta data policies to this role.

## Register the connection

1. In your Amazon Redshift environment, create an **Immuta database** that Immuta can use to connect to your Amazon Redshift instance to register the connection and maintain state with Amazon Redshift.

   Having this separate database for Immuta prevents custom ETL processes or jobs deleting the database you use to register the connection, which would break the connection.
2. In Immuta, click <i class="fa-database">:database:</i> **Data** and select **Connections** in the navigation menu.
3. Click the **+ Add Connection** button.
4. Select the **Amazon Redshift** tile.
5. Enter the connection information:
   1. **Display Name:** This is the name of your new connection. This name will be used in the API (`connectionKey`), in data source names from the host, and on the connections page. Avoid the use of periods (`.`) or [restricted words](#user-content-fn-1)[^1] in your connection name.
   2. **Hostname**: URL of your Amazon Redshift instance.
   3. **Port**: Port configured for Amazon Redshift.
   4. **Database**: The Redshift database you created for Immuta. All databases in the host will be registered.
   5. **SSL Mode**: Use the dropdown to select the SSL mode to connect to the host.
      1. **Prefer**: Use this mode to try an encrypted connection and fallback to unencrypted if needed.
      2. **Require**: Use this mode for encrypted connections.
      3. **Disable**: Use this mode for plain, unencrypted connections.
6. Enter the **username** and **password** of the [Amazon Redshift database user you created above](#create-the-database-user).
7. Click **Next**.
   1. Opt to **Enable Object Sync**, which will keep your connection objects up to date with your Redshift environment.
      1. Select the **Start Time** for when the first object sync job will run each day.
      2. Select the **Run Frequency** to determine how frequently object sync will run each day.
      3. Opt to **Run Object Sync on Create** to create all the data objects for your connection. If you do not select this option, you must run object sync manually or wait for the scheduled object sync for your connection's data objects.
8. Click **Save connection**.
9. Copy the provided script and run it in Redshift as a user with the privileges [listed in the permissions section](#permissions).&#x20;
10. Click **Validate Connection**.
11. If the connection is successful, click **Finish**. If there are any errors, check the connection details and credentials to ensure they are correct and try again.

{% hint style="info" %}
**MD5 unsupported**

Passwords hashed using MD5 are unsupported for authentication.
{% endhint %}

[^1]: Your display name cannot be any of the following words: `data`, `connection`, `object`, `crawl`, `search`, `settings`, `metadata`, `permission`, `sync`, `bulk`, and `upgrade`.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://documentation.immuta.com/SaaS/configuration/integrations/redshift/amazon-redshift-integration/register-an-amazon-redshift-connection.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.