Connector guide
Connect Amazon Redshift safely
Least-privilege setup for provisioned clusters and Serverless workgroups
1. Create a dedicated reader
Create a non-admin database user or IAM-authenticated service identity. Grant CONNECT, schema USAGE, and SELECT only on curated reporting views.
2. Restrict network and authentication
- Require TLS with hostname verification.
- Prefer private connectivity or narrowly allow Maya egress addresses.
- Use short-lived IAM credentials when deployment support is enabled.
3. Expose only approved data
- Use a dedicated reporting schema.
- Do not grant CREATE, TEMP, INSERT, UPDATE, DELETE, or system-table access.
- Redact regulated and identifying columns.
4. Verify before connecting
- Confirm the identity cannot mutate data.
- Test only approved schema-qualified SELECT statements.
- Confirm query, row, and output-byte limits.
5. Rotate and revoke
Rotate secrets or keys on a defined schedule and immediately after suspected exposure. Disconnect the integration in Maya before disabling the external identity, and retain only non-sensitive audit metadata.