# Amazon Redshift

- URL: https://betteranalyst.com/docs/connectors/redshift
- Updated: 2026-10-28
- Author: Better Analyst

Connect Amazon Redshift provisioned clusters or Redshift Serverless to Better Analyst, with read-only user setup, network access, Data Flows and per-member row rules.

Connect an Amazon Redshift provisioned cluster or a Redshift Serverless workgroup to ask questions in plain English, build dashboards that refresh on a schedule, and move results with Data Flows.

## Prerequisites

- A Redshift provisioned cluster or Serverless workgroup
- A database user and password (IAM authentication is not supported yet)
- Network access from Better Analyst to the cluster or workgroup

## Connection Details

| Field | Description | Example |
| - | - | - |
| Endpoint | Cluster or workgroup endpoint host | `my-cluster.abc123.us-east-1.redshift.amazonaws.com` |
| Port | Redshift port | `5439` |
| Username | Database user | `better_analyst` |
| Password | Database user password | `********` |
| Database | Database to query | `dev` |
| SSL | Always required by default | `Require` |

You can paste the full **Endpoint** value from the Redshift console (for example `my-cluster.abc123.us-east-1.redshift.amazonaws.com:5439/dev`). Better Analyst fills in the port and database for you.

## Setup Steps

### 1. Create a Read-Only User

```sql
CREATE USER better_analyst PASSWORD 'Your-secure-password1';

GRANT USAGE ON SCHEMA public TO better_analyst;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO better_analyst;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO better_analyst;
```

Repeat the `GRANT` statements for every schema you want to analyze. Do not use the admin user: queries run with whatever privileges the user has.

### 2. Allow Network Access

Better Analyst connects from these addresses:

- `74.220.50.0/24`
- `74.220.58.0/24`

1. Turn on **Publicly accessible** for the cluster (Actions > Modify publicly accessible setting) or the Serverless workgroup (Network and security).
2. In the VPC security group attached to the cluster or workgroup, add an inbound rule for TCP on the Redshift port (5439) from the addresses above.

Clusters that are reachable only inside a private VPC cannot be connected yet.

### 3. Connect in Better Analyst

1. Go to **Data** > **Databases and warehouses** > **Amazon Redshift**
2. Paste the endpoint and enter the username, password, and database
3. Choose **Read only** (default) or **Read and write** if you want Data Flows to write tables into Redshift
4. Click **Connect Redshift**

## How Queries Run

- Every query is a single read-only `SELECT`, run inside a read-only transaction and checked before it reaches Redshift.
- Better Analyst writes Redshift SQL: `DATEADD`, `DATEDIFF`, `DATE_TRUNC`, `LISTAGG`, `GETDATE()`, and `APPROXIMATE COUNT(DISTINCT ...)` are all used where they help.
- Large results are exported in the background and attached to the chat as a file.

## Example Questions

- "Total revenue by region last quarter"
- "Weekly active customers for the last 6 months"
- "Top 20 products by margin this year"
- "Which tables in the analytics schema were updated today?"

## Dashboards, Alerts and Data Flows

- **Dashboards** built from Redshift data refresh on a schedule, using the same saved query.
- **Alerts** watch Redshift-backed numbers through Data Flows.
- **Data Flows** can read from Redshift and, with **Read and write** access, write tables into an approved Redshift schema.

## Access Control

From **Manage Data Access** you can:

- Limit which tables and columns the AI can see
- Add row rules, including per-member rules that filter rows by a team member's attributes
- Preview what a member sees with **View as member**

## Troubleshooting

| Problem | Fix |
| - | - |
| Connection timed out | Make the cluster publicly accessible and allow the IP addresses above in its security group. |
| Password authentication failed | Check the username and password; Redshift passwords are case-sensitive. |
| Permission denied for relation | Grant `USAGE` on the schema and `SELECT` on the table to the Better Analyst user. |
| Database does not exist | Use the database name from the endpoint, often `dev`. |