How do I turn off temporary credentials access to the Amazon Redshift query editor?

Short description

You can use AWS Secrets Manager or AWS Identity and Access Management (IAM) temporary credentials to access an Amazon Redshift cluster with the query editor. To connect with temporary credentials, users can use either a database username or an IAM identity.

For more information, see Connecting to an Amazon Redshift database.

Resolution

To create an IAM policy to restrict temporary credentials access to the Amazon Redshift query editor, complete the following steps:

1. Open the IAM console.

2. Create an IAM user.

3. In the navigation pane, choose Users.

4. In User name, choose the IAM user that you want to use to prevent access to the query editor.

5. Choose the Permissions tab, and then choose Add inline policy.

6. Choose the JSON policy tab, and then paste the following policy:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "VisualEditor0",
               "Effect": "Deny",
               "Action": [
                   "redshift:GetClusterCredentialsWithIAM",
                   "redshift:GetClusterCredentials"
               ],
               "Resource": [
                   "arn:aws:redshift:*:<account-id>:dbgroup:*/*",
                   "arn:aws:redshift:*:<account-id>:dbname:*/*",
                   "arn:aws:redshift:*:<account-id>:dbuser:*/*"
               ]
           }
       ]
   }

   Note: Replace account-id with your AWS account ID.

7. Choose Review policy.

8. For Name, enter a name for the policy, and then choose Create policy.

When an IAM user with temporary credentials tries to access the query editor, they receive a similar error to the following: "Databases couldn't be listed".

Related information

Why can't I connect to the AmazonRedshiftQueryEditor in Amazon Redshift?