Simplify multi-warehouse information governance with Amazon Redshift federated permissions

January 5, 2026

10

Trendy information architectures more and more depend on multi-warehouse deployments to realize workload isolation, value optimization, and efficiency scaling. Amazon Redshift federated permissions simplify permissions administration throughout a number of Redshift warehouses.

With federated permissions, you register Redshift warehouse namespaces with the AWS Glue Information Catalog, making a unified catalog that spans your whole warehouse fleet within the account. Registered namespaces are routinely mounted in each warehouse, offering information discovery with out guide configuration. You possibly can outline permissions on database objects utilizing acquainted Redshift SQL instructions, specifying world identities by AWS Identification and Entry Administration (IAM) or AWS IAM Identification Middle (IDC). These permissions are saved alongside the warehouse information and enforced constantly, no matter which warehouse runs the question. This supplies a unified and safe entry management mannequin throughout your Redshift surroundings.

On this publish, we present you methods to outline information permissions one time and routinely implement them throughout warehouses in your AWS account, eradicating the necessity to re-create safety insurance policies in every warehouse.

Key capabilities of Amazon Redshift federated permissions

Federated permissions in Amazon Redshift supply the next key capabilities:

World identification integration – Federated permissions use IAM and IAM Identification Middle to offer single sign-on (SSO) throughout all registered warehouses. Customers authenticate one time by their present identification supplier (IdP) and obtain constant entry primarily based on their world identification, no matter which warehouse they connect with. This alleviates the necessity to create and handle separate consumer accounts in every warehouse, lowering administrative overhead and bettering the consumer expertise.
Unified catalog with automated mounting – Once you register a Redshift namespace with the Information Catalog utilizing federated permissions, it turns into routinely seen in all warehouses inside your account. Analysts utilizing the Amazon Redshift Question Editor v2 or their most popular SQL consumer can uncover and question tables throughout registered warehouses with out guide catalog configuration. This automated mounting functionality simplifies information discovery and permits cross-warehouse analytics.
Constant fine-grained entry management – Row-level safety (RLS) insurance policies, dynamic information masking (DDM) insurance policies, and column-level safety (CLS) outlined on warehouses utilizing Amazon Redshift federated permissions routinely implement when information is queried from consuming warehouses. You possibly can implement superior entry controls—reminiscent of AWS Area-based row filtering, role-based masking for delicate columns like SSN or bank card numbers, and time-based entry restrictions—with confidence that these insurance policies apply throughout warehouses.
SQL-based permission administration – Federated permissions use acquainted Redshift SQL syntax for permission administration. You create RLS insurance policies with CREATE RLS POLICY, connect them to tables and roles with ATTACH RLS POLICY, outline masking insurance policies with CREATE MASKING POLICY, and grant permissions with commonplace GRANT statements. This SQL interface permits infrastructure as code (IaC) approaches, helps database directors to make use of their present expertise, and integrates naturally with present extract, remodel, and cargo (ETL) and automation workflows that use IAM or IAM Identification Middle authentication.

Multi-warehouse structure with federated permissions

The multi-warehouse structure with federated permissions in Amazon Redshift represents an information mesh strategy the place a number of impartial compute sources function on shared information with unified governance. The next diagram illustrates the Redshift federated permissions setup course of with the Information Catalog.

The method consists of the next steps:

Every Redshift warehouse (1,2…N) registers with the Information Catalog. Refer onboarding documentation on registering the warehouse.
After you register your Redshift warehouses with the Information Catalog, you’ll be able to question information throughout your warehouses. Registered catalogs are routinely mounted in each warehouse within the account, showing within the database explorer of Question Editor v2, and SQL purchasers linked to Amazon Redshift. To question a desk in a registered catalog, use the three-part naming conference: database@catalog_name.schema_name.table_name.
Once you run a cross-catalog question, Amazon Redshift propagates your world identification (IAM position or IAM Identification Middle consumer) to the distant warehouse. The distant warehouse’s catalog occasion validates your permissions in opposition to the grants and fine-grained entry management insurance policies outlined on the queried tables. If in case you have the required permissions, the desk metadata and any relevant RLS, DDM, or CLS insurance policies are returned to the consuming warehouse. Your native warehouse’s compute occasion integrates these safety insurance policies into the question execution plan and runs the question on Redshift Managed Storage (RMS).

The enforcement of fine-grained entry controls on distant information is a key differentiator of federated permissions. Conventional Redshift information sharing doesn’t assist RLS or DDM insurance policies on shared tables. With federated permissions, the safety insurance policies outlined on the distant warehouse routinely apply when information is queried from any client warehouse. This helps compliance with information governance necessities with out requiring directors to duplicate safety insurance policies throughout warehouses.

The multi-warehouse structure scales horizontally with out growing governance complexity. Once you add a brand new warehouse to your account and register it with federated permissions, it routinely inherits the suitable permission mannequin with out guide configuration. Analysts connecting to the brand new warehouse instantly see all databases they’ve entry to throughout the mesh, and all safety insurance policies apply routinely. This alleviates the N-squared downside of managing permissions throughout N warehouses, lowering the executive burden from N separate configurations to a single unified governance mannequin.

Question lifecycle

The next diagram illustrates the step-by-step circulate of how a consumer question on Redshift Warehouse 1 accesses objects in Redshift Warehouse N with federated permissions.

Be aware: Steps 2, 3, and 4 shall be skipped if permission particulars can be found within the native cache

The workflow consists of the next steps:

The consumer connects to Redshift Warehouse 1 and queries a desk in Federated Catalog N.
Redshift Warehouse 1 calls the Information Catalog GetTable API. This request consists of the consumer’s token.
The request routes to Redshift Warehouse N.
Redshift Warehouse N verifies the consumer permissions. If it’s approved, it returns the desk metadata and safety coverage particulars reminiscent of RLS insurance policies, DDM guidelines, and CLS settings.
Redshift Warehouse 1 applies the safety insurance policies within the question plan and runs the question in opposition to Redshift Managed Storage (RMS), the place Redshift shops information in an optimized format.
The outcomes are returned to the consumer.

Answer overview

The instance on this publish demonstrates methods to outline RLS and DDM insurance policies on an information warehouse and confirm that these insurance policies are enforced when querying from one other information warehouse.

We’ll create a desk with bank card information and apply RLS and DDM insurance policies to restrict client playing cards information and masks bank card values for non-admin customers. These insurance policies shall be utilized throughout all the information warehouses constantly and masks the bank card particulars when non-admin customers question the desk.

Conditions

Create the next IAM roles:

Create desk and cargo information

Run following steps to create a credit_card desk and cargo pattern information.

Connect with the primary Redshift information warehouse1 utilizing the IAM Aadmin position

Create a credit_cards desk

-- Create desk
CREATE TABLE credit_cards (
  customer_id INT,
  credit_card varchar(16),
  card_type varchar(10)
);

Insert pattern information

-- Insert pattern information
INSERT INTO credit_cards
VALUES
  (100, '4532993817514842', 'client'),
  (100, '4716002041425888', 'company'),
  (102, '5243112427642649', 'client'),
  (102, '6011720771834675', 'client'),
  (102, '6011378662059710', 'company'),
  (103, '373611968625635', 'client');

Apply RLS and DDM insurance policies

Run following steps to create and apply RLS and DDM insurance policies.

Create an RLS coverage to filter solely client card varieties:

-- Create RLS coverage
CREATE RLS POLICY consumer_cards
WITH (card_type VARCHAR(10))
USING (card_type="client");

Create a DDM coverage that masks bank cards:

-- Create masking coverage
CREATE MASKING POLICY mask_credit_card_full
WITH (credit_card VARCHAR(256))
USING ('000000XXXX0000'::TEXT);

Connect RLS and DDM Insurance policies to RedOnly position

-- Connect RLS and DDM insurance policies to ReadOnly position
ATTACH RLS POLICY consumer_cards 
ON credit_cards 
TO "IAMR:ReadOnly";

ATTACH MASKING POLICY mask_credit_card_full
ON credit_cards(credit_card)
TO "IAMR:ReadOnly";

Allow Row Degree Safety on the desk

ALTER TABLE credit_cards ROW LEVEL SECURITY ON;

Grant choose on the desk to Readonly position

GRANT SELECT ON credit_cards TO "IAMR:ReadOnly";

Connect with information warehouse 2 as read-only consumer

Run following steps on information warehouse 2 to question the information.

Connect with information warehouse 2 as a read-only consumer and broaden the exterior databases. The next screenshot reveals an instance utilizing Question Editor V2.
Discover the credit_cards desk from information warehouse 1 if you broaden the catalog.
Run the next SQL to question the desk. Exchange rs-demo-dw1 within the following SQL with the catalog title you gave whereas registering information warehouse 1:
```
-- SQL to question bank cards desk in information warehouse1. 
SELECT * FROM "dev@rs-demo-dw1"."public"."credit_cards";
```
You must see solely client sort bank cards with card particulars masked within the output. The RLS and DDM insurance policies utilized in information warehouse 1 on the IAMR:ReadOnly consumer are enforced despite the fact that you queried the desk from a unique information warehouse.

The next screenshot reveals an instance output.

For auditing, you’ll be able to run SHOW instructions to view the insurance policies utilized on the tables for the roles:

-- Present all RLS insurance policies within the database.
SHOW RLS POLICIES FROM DATABASE "dev@rs-demo-dw1";
-- Present all masking insurance policies within the database.
SHOW MASKING POLICIES FROM DATABASE "dev@rs-demo-dw1";

This instance demonstrates the ability of federated permissions: safety insurance policies outlined one time on a warehouse routinely implement throughout your warehouses, sustaining compliance with out duplicating coverage definitions.

Concerns

Have in mind the next when utilizing federated permissions:

Clear up

To keep away from incurring future expenses, delete the sources you created, together with the Redshift information warehouses and IAM roles.

Conclusion

Amazon Redshift federated permissions remodel multi-warehouse information governance right into a streamlined, automated course of. For organizations working a number of Redshift warehouses, federated permissions ship fast worth by lowering administrative time and supporting constant safety enforcement. The acquainted SQL interface and backward compatibility with present Redshift permissions allow speedy adoption with out requiring groups to be taught new governance fashions.

The mixing with IAM and IAM Identification Middle supplies enterprise-grade identification administration with SSO capabilities, and the automated mounting of registered catalogs simplifies information discovery and cross-warehouse analytics. In case you are at the moment utilizing Amazon Redshift native permissions, discuss with the software described in Modernize Amazon Redshift authentication by migrating consumer administration to AWS IAM Identification Middle.

To be taught extra and get began, see Amazon Redshift Federated Permissions documentation.