IAM passthrough - GetClusterCredentialswithIAM for Redshift Data Sources - implemented for Redshift Serverless?

Question

**Issue**
After the May 2024 announcement about Amazon QuickSight supporting GetClusterCredentialsWithIAM for Redshift data sources (https://aws.amazon.com/about-aws/whats-new/2024/05/amazon-quicksight-getclustercredentialswithiam-redshift-data-sources/), we've encountered issues specifically with Redshift Serverless. While the feature appears to work with provisioned Redshift clusters, we've found what seems to be a documentation gap or implementation inconsistency with Redshift Serverless workgroups.

**Important Documentation Note**
We've found potentially conflicting information. The QuickSight documentation explicitly states: "The run-as role is not supported for Amazon Redshift Serverless data sources" (https://docs.aws.amazon.com/quicksight/latest/user/datasource-run-as-role.html).

However, the May 2024 announcement doesn't mention this limitation, which creates confusion about whether IAM authentication is supported for Redshift Serverless at all, or if it's just the run-as role functionality that's not supported.

**What We've Tried**
1. Configured QuickSight data source using proper IAM roles with necessary permissions
2. Verified the IAM user exists in the database (confirmed via SQL query)
3. Tested multiple configurations with the ClusterId parameter and IAMParameters
4. Reviewed documentation thoroughly for Redshift Serverless-specific instructions

**Current Status**
Despite following all available documentation, we cannot successfully authenticate to Redshift Serverless workgroups using IAM authentication from QuickSight. The connection consistently fails.
Questions

Does the documentation limitation about run-as roles mean that GetClusterCredentialsWithIAM is not supported for Redshift Serverless at all?
If IAM authentication is possible with Redshift Serverless, what specific configuration should be used?
Has anyone else successfully implemented this feature with Redshift Serverless, and if so, what configuration worked?

**Workarounds We're Considering**
For now, we're considering:

* Using database credentials (less preferred from a security standpoint)
* AWS Secrets Manager integration
* Opening an AWS Support case for clarification

Any guidance from the AWS team or community would be greatly appreciated!

re:Post Agent · Answer

Based on the available information, it appears that there is indeed some confusion and potential inconsistency regarding the support for GetClusterCredentialsWithIAM for Amazon Redshift Serverless in Amazon QuickSight.

The May 2024 announcement about QuickSight supporting GetClusterCredentialsWithIAM for Redshift data sources does not explicitly mention any limitations for Redshift Serverless. However, the QuickSight documentation clearly states that the run-as role is not supported for Amazon Redshift Serverless data sources.

This discrepancy creates uncertainty about whether IAM authentication is supported for Redshift Serverless at all, or if it's just the run-as role functionality that's not supported.

Given the conflicting information and your unsuccessful attempts to authenticate to Redshift Serverless workgroups using IAM authentication from QuickSight, it seems that there might be limitations or issues with this feature for Redshift Serverless.

At this point, it's unclear whether GetClusterCredentialsWithIAM is fully supported for Redshift Serverless or if there are specific configurations required. The documentation doesn't provide clear guidance on this matter.

Considering the current situation, your workaround options seem appropriate:

1. Using database credentials, although this is less preferred from a security standpoint.
2. Integrating with AWS Secrets Manager for credential management.
3. Opening an AWS Support case for clarification is highly recommended. This will not only help you get a definitive answer but also potentially highlight a documentation gap or implementation inconsistency that AWS needs to address.

Given the lack of clear documentation or successful implementation examples, seeking direct support from AWS is likely the best course of action. They can provide the most up-to-date and accurate information about the feature's support for Redshift Serverless and guide you on the correct configuration if it is indeed possible.

In the meantime, using one of the workaround options you've identified would be a pragmatic approach to ensure your system remains functional while awaiting clarification from AWS support.  
**Sources**  
[Amazon QuickSight now supports GetClusterCredentialswithIAM for Redshift Data Sources - AWS](https://aws.amazon.com/about-aws/whats-new/2024/05/amazon-quicksight-getclustercredentialswithiam-redshift-data-sources/)  
[Running queries as an IAM role in Amazon QuickSight - Amazon QuickSight](https://docs.aws.amazon.com/quicksight/latest/user/datasource-run-as-role.html)

IAM passthrough - GetClusterCredentialswithIAM for Redshift Data Sources - implemented for Redshift Serverless?

Add your answer

Relevant content