Controlling Access to Amazon
Redshift Resources
This topic describes how you can use AWS Identify and Access Management (IAM) to control access to
your Amazon Redshift resources.
Introduction
Your AWS account credentials provide unrestricted access to your AWS account. If you use your account
credentials for access, other users will need your credentials to access your Amazon Redshift resources,
and they will have the same unrestricted access. As a result, we strongly recommend that instead of
using your account credentials to create or manage Amazon Redshift resources, you use AWS Identity
and Access Management (IAM).
Using IAM, you can create IAM users under the umbrella of your AWS account. You can create multiple
users and can organize them into IAM groups. Each user has his or her own credentials and only the
permissions that you explicitly grant, so that you do not have to share your account credentials with other
users.
By default, IAM users have no permissions; you must grant permissions to a user so that the user can
perform Amazon Redshift actions. To define permissions, you create a policy, which is a JSON document
in which you specify the actions and resources that you are granting access to. You then attach the policy
to an IAM user to grant the specified access to that user, or to an IAM group to give all the users in that
group the permissions that are specified in the policy. For more information, see the following topics:
•
Introduction
– An introduction to AWS IAM and users.
•
Permissions and Policies
– Information about permissions and policies, including how to create and
manage them.
•
IAM Best Practices
– General recommendations for using IAM to help secure access to your AWS
resources.
API Version 2012-12-01
90
Amazon Redshift Management Guide
Introduction
