Prerequisites for Access Management for AWS Redshift Connector¶

Before integrating AWS Redshift with Privacera, ensure that you have the necessary Redshift database, users and roles required by PolicySync Connector. Below are the prerequisites for setting up the AWS Redshift connector with Privacera.

Recommendations for Creating Redshift User and Role¶

For performing the below steps, log in to Redshift as a user with SUPERUSER privileges.

Redshift Role for Connector¶

The role created in this step will be used when configuring the Redshift connector with Privacera. The suggested name for the role is privacera_policysync_redshift_role, but you can use a different name if preferred.

Since the Privacera connector manages access policies in Redshift and can create users and roles in Redshift, the role should have the necessary privileges to manage permissions for all tables and views in the database. Additionally, if Privacera is managing users and groups in Redshift, the role should have the necessary privileges to create, update and delete users and roles in Redshift.

Here are the steps to create the role and grant the necessary privileges to the role:

1. Drop the role if it already exists.

   SQL
   1 2	REVOKE ROLE "privacera_policysync_redshift_role" FROM "privacera_policysync_redshift_user"; DROP ROLE IF EXISTS privacera_policysync_redshift_role;

2. Create a new role.

   SQL
   1	CREATE ROLE "privacera_policysync_redshift_role";

3. Grant system catalog access to the role.

   SQL
   1 2	GRANT SELECT ON ALL TABLES IN SCHEMA pg_catalog TO role privacera_policysync_redshift_role; GRANT SELECT ON ALL TABLES IN SCHEMA information_schema TO role privacera_policysync_redshift_role;

4. Grant schema-specific permissions (replace with your actual database and schema names).

   SQL
   1 2 3 4	-- Replace 'your_database.your_schema' with actual database and schema names GRANT USAGE ON SCHEMA your_database.your_schema TO role privacera_policysync_redshift_role; GRANT SELECT ON ALL TABLES IN SCHEMA your_database.your_schema TO role privacera_policysync_redshift_role; GRANT CREATE ON SCHEMA your_database.your_schema TO role privacera_policysync_redshift_role;

   Schema Permissions

   Replace your_database.your_schema with the actual database and schema names you want to manage. You may need to repeat these commands for multiple schemas.

Database User for Privacera Connector¶

The Privacera connector requires a user to connect to Redshift and manage access policies. The user should have the necessary privileges to manage access policies in Redshift. The suggested name for the user is privacera_policysync_redshift_user, but you can use a different name if preferred. You need to create this database user and grant access to the role privacera_policysync_redshift_role.

1. Drop the user if it already exists.

   SQL
   1	DROP USER IF EXISTS "privacera_policysync_redshift_user";

2. Create the database user.

   SQL
   1	CREATE USER "privacera_policysync_redshift_user" WITH PASSWORD '<PLEASE_CHANGE>';

   Replace Password

   Replace <PLEASE_CHANGE> with a strong password for the privacera_policysync_redshift_user.

3. Grant the role to the user.

   SQL
   1	GRANT ROLE "privacera_policysync_redshift_role" TO "privacera_policysync_redshift_user";

4. Grant user creation privileges directly to the user.

   SQL
   1	ALTER USER "privacera_policysync_redshift_user" CREATEUSER;

   User Creation Privileges

   In Redshift, the CREATEUSER privilege needs to be granted directly to the user, not to the role.

Complete Setup Script¶

Here is the complete SQL script to set up the Redshift user and role for Privacera:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

-- Clean up any existing user/role (if they exist)
REVOKE ROLE "privacera_policysync_redshift_role" FROM "privacera_policysync_redshift_user";
DROP ROLE IF EXISTS privacera_policysync_redshift_role;
DROP USER IF EXISTS "privacera_policysync_redshift_user";

-- Create the dedicated role
CREATE ROLE "privacera_policysync_redshift_role";

-- Create the dedicated service user
CREATE USER "privacera_policysync_redshift_user" WITH PASSWORD '<PLEASE_CHANGE>';

-- Grant the role to the user
GRANT ROLE "privacera_policysync_redshift_role" TO "privacera_policysync_redshift_user";

-- Grant system catalog access to the role
GRANT SELECT ON ALL TABLES IN SCHEMA pg_catalog TO role privacera_policysync_redshift_role;
GRANT SELECT ON ALL TABLES IN SCHEMA information_schema TO role privacera_policysync_redshift_role;

-- Grant user creation privileges directly to the user
ALTER USER "privacera_policysync_redshift_user" CREATEUSER;

-- Grant schema-specific permissions (replace with your actual database and schema names)
-- Example: GRANT USAGE ON SCHEMA your_database.your_schema TO role privacera_policysync_redshift_role;
-- Example: GRANT SELECT ON ALL TABLES IN SCHEMA your_database.your_schema TO role privacera_policysync_redshift_role;
-- Example: GRANT CREATE ON SCHEMA your_database.your_schema TO role privacera_policysync_redshift_role;

Planned Deployment¶

Privacera connector will apply new permissions as per the policies defined in Privacera. The existing grants and permissions for the users, groups and roles in Redshift will not be removed by Privacera connector.

You can start by specifying a subset of schemas and tables to be managed by Privacera connector, and then you can later remove the restrictions to manage all the objects in your Redshift database cluster.

Similarly, you can start by specifying a subset of users and groups to be managed by Privacera connector, and then you can later remove the restrictions to manage all the users and groups in your Redshift database cluster.

If you have existing grants, you may want to convert them into Privacera policies and then remove the existing grants. Privacera Professional Services can help you with this conversion.

Comments