Connect Redshift to Rig

    Rig connects to Amazon Redshift as an ordinary database user. You create the user in SQL, give it read access to the schemas Rig should see, and enter the host, port, database and login in the form.

    Before you start

    • A Redshift superuser, or a user with the CREATE USER privilege, to create the login.
    • The Host of your cluster or workgroup, the Port and the database name.
    • Network access from Rig to the endpoint.
    • A workspace owner, or a role with the Manage connections permission, in Rig.

    Step 1: Create a Redshift user for Rig

    1. Connect to your database as a superuser or as a user with the CREATE USER privilege.
    2. Run CREATE USER rig_reader PASSWORD '<password>'. A clear text password must be 8 to 64 characters with at least one uppercase letter, one lowercase letter and one number. Avoid ', ", \, / and @.
    3. Grant the user read access to the schemas and tables Rig should see. Keep the grants read-only.

    Public schema
    By default every Redshift user can create objects in the public schema. Revoke that privilege from the Rig user if you want its access to stay strictly read-only.

    Step 2: Create a separate write user if Rig should ingest

    Skip this step if Rig only needs to read.

    1. Create a second user with its own password and give it the privileges to create and write tables in the database Rig loads into.
    2. Rig refuses a write password that matches the read one.

    Step 3: Connect it in Rig

    Adding a source needs a workspace owner, or a role with the Manage connections permission, on a workspace where you manage your own connections. If the Connectors tab says “Data ingestion for this workspace is managed by Rig”, ask an owner or Rig support to add the source.

    1. In Rig, open Connections. On a workspace with no warehouse yet, the page shows a Set up your warehouse card. Choose Bring your own warehouse.
    2. If the workspace already has a warehouse, open the Warehouse stage, click Change warehouse, choose Bring your own and pick the type. Your connected sources and schedules are kept, and data already synced is not copied across, so re-sync afterwards.
    3. Choose Redshift as the Warehouse type.
    4. Host: the endpoint host of your cluster or workgroup, for example rig.abc123.eu-west-1.redshift.amazonaws.com.
    5. Port: leave it as 5439 unless your endpoint uses another port.
    6. Database: the database Rig should read, for example analytics.
    7. Username: the user you created, for example rig_reader.
    8. Password: that user's password.
    9. The credential fields appear once for the read credential, labelled with a (read) suffix. Rig only reads your warehouse unless you add a write credential.
    10. To let Rig also sync your connected tools into this warehouse, switch on Let Rig ingest data into this warehouse and fill the same credential fields again, now labelled (write / ingestion). The write credential must differ from the read one, and Rig blocks the form if they match.
    11. Click Provision workspace. Rig stores the credentials in AWS Secrets Manager and does not echo them back.
    12. To rotate a credential later, open the Warehouse stage and click Update credentials. Fill in only what you want to change and leave the rest blank.

    What Rig reads

    • Schemas, tables and views: Rig reads the structure of the database and builds its context layer from it.
    • dbt models: Tables that dbt builds are read like any other table, with dbt lineage kept alongside them.
    • Query results: Questions run as Redshift SQL on your cluster, and results go to the person asking.
    • Ingested sources: Only if you add a write user, Rig also creates schemas for the tools you sync.

    With only a read user Rig cannot create or change tables.

    Good to know

    • Redshift system tables show a regular user only that user's own rows unless the user has SYSLOG ACCESS UNRESTRICTED. Usage views built from them can look sparse for a read-only Rig user.
    • A VALID UNTIL date on the user makes the password stop working at that time, so leave it unset or put the expiry in your calendar.
    • A password that contains ', ", \, / or @ is rejected by Redshift for new users, so pick a different one.
    • The password is stored in AWS Secrets Manager and is never logged.

    What people use this for

    • Answer business questions over Redshift without SQL
    • Query Redshift Spectrum and S3 data lake tables
    • Serve Redshift data to Claude, Cursor and ChatGPT
    • Keep Redshift queries safe and bounded

    More ideas for using Amazon Redshift

    Redshift documentation

    Was this guide helpful?