Connect Amazon Redshift

Give Halo a read-only Redshift user and your endpoint, test it, and run discovery. For a provisioned cluster or a Serverless workgroup.

Connect a Redshift cluster or Serverless workgroup and Halo reads your tables as they are. You'll have a connection, and discovery will map what's in it.

Before you start

• In Redshift: someone who can create a user and grant access. If that's your IT team, send them this page and Allowlists, SSH tunnels and read-only logins.

• In Halo: permission to manage connections, which Owners, Admins and Builders have by default. See Roles and permissions.

Create a read-only user

Make a user for Halo that can read only what it should. Repeat the schema lines for each schema.

create user halo_reader password 'Use-a-Long-Random-Passw0rd';

grant usage on schema sales to halo_reader;
grant select on all tables in schema sales to halo_reader;

-- Also cover tables created in the schema later.
alter default privileges in schema sales grant select on tables to halo_reader;

alter default privileges covers tables made by the user who runs it. For tables another user creates, add for user with that user's name. For an external (Spectrum) schema, grant usage on the schema, and see AWS's documentation for what your catalog needs.

Network

Halo's servers connect to your endpoint on its port, 5439 by default, so the endpoint has to be reachable from them and its security group has to let them in.

A cluster reachable only inside a private network can connect through a bastion host, under SSH tunnel in the connection's settings. See SSH tunnels.

Add the connection

1. Open Data, then New connection, and choose Amazon Redshift.

2. Under Details, give it a Name and choose a Workspace.

3. Fill in Connection settings:

   Setting	What to enter
   Endpoint	The cluster's or workgroup's endpoint, without the port and database
   Port	5439 unless yours differs
   Database	The database's name. dev is filled in
   User	halo_reader, or the user you made
   Password	Its password. It's encrypted and never shown again
   TLS	require encrypts without checking who the server is, and is the default. verify-ca and verify-full also check its certificate. Don't use disable outside a private network
   Schemas	Optional. Schemas to include, each its own (press Enter or type a comma after each), external ones too. All readable schemas otherwise

Sign-in is by user and password. IAM sign-in isn't available yet. TLS certificates takes your own certificate authority, and a client certificate and key. See TLS.

Test it

Choose Test connection. You'll see Connected and the server's version, or Couldn't connect with Redshift's own error. Two warnings can appear even when it connects:

• "This user is a superuser. Connect with a read-only user instead."

• "This user can change data. Halo only reads, but a read-only user is safer."

Halo still only reads either way, but fix these before you go on.

Save and discover

Choose Save and discover. Discovery reads your tables, including late-binding views and external tables, with sizes and keys from Redshift's system views. Its profiles read a sample of rows and count distinct values approximately, to go easy on your cluster.

If it finishes with No tables found, the user can't see any schemas. Grant it access, and choose Run discovery again.

From there it works like any other source: datasets, calculated fields, extracts and row policies work the same way.

Change the password later

1. Change it in Redshift, at a quiet time, or make a second user first to avoid a gap:

   alter user halo_reader password 'A-New-Long-Random-Passw0rd';

2. In Halo, open the connection's Settings tab, type the new password, and save.

3. Choose Test connection on the connection's page.

What Halo stores, and how it's encrypted, is in What Halo stores.