---
title: Database Access with Redshift on AWS
description: How to configure Teleport Database Access with AWS Redshift PostgreSQL.
videoBanner: UFhT52d5bYg
---

This guide will help you to:

- Install Teleport `(=teleport.version=)`.
- Set up Teleport to access your AWS Redshift instances.
- Connect to your databases through Teleport.

<ScopedBlock scope={["oss", "enterprise"]}>
![Teleport Database Access Redshift Self-Hosted](../../../img/database-access/guides/redshift_selfhosted.png)
</ScopedBlock>
<ScopedBlock scope={["cloud"]}>
![Teleport Database Access Redshift Cloud](../../../img/database-access/guides/redshift_cloud.png)
</ScopedBlock>

## Prerequisites

(!docs/pages/includes/edition-prereqs-tabs.mdx!)

- AWS account with a Redshift cluster and permissions to create and attach IAM
  policies.
- Command-line client `psql` installed and added to your system's `PATH` environment variable.
- A host, e.g., an EC2 instance, where you will run the Teleport Database
  Service.

(!docs/pages/includes/tctl.mdx!)

## Step 1/5. Create a Teleport user

(!docs/pages/includes/database-access/create-user.mdx!)

## Step 2/5. Create a Database Service configuration

(!docs/pages/includes/database-access/token.mdx!)

Install Teleport on the host where you will run the Teleport Database Service:

(!docs/pages/includes/install-linux.mdx!)

On the node that is running the Database Service, create a configuration file:

<ScopedBlock scope={["oss", "enterprise"]}>

```code
$ teleport db configure create \
   -o file \
   --proxy=teleport.example.com:3080 \
   --token=/tmp/token \
   --redshift-discovery=us-west-1
```

</ScopedBlock>
<ScopedBlock scope={["cloud"]}>

```code
$ teleport db configure create \
   -o file \
   --proxy=mytenant.teleport.sh:443 \
   --token=/tmp/token \
   --redshift-discovery=us-west-1
```

</ScopedBlock>

The command will generate a Database Service configuration with Redshift
database auto-discovery enabled on the `us-west-1` region and place it at the
`/etc/teleport.yaml` location.

## Step 3/5. Create an IAM policy for Teleport

Teleport needs AWS IAM permissions to be able to:

- Discover and register Redshift databases.
- Manage IAM user or IAM role policies.

Before you can generate IAM permissions, you must provide the Teleport Database
Service access to AWS credentials.

(!docs/pages/includes/aws-credentials.mdx service="the Database Service"!)

(!docs/pages/includes/database-access/aws-bootstrap.mdx!)

## Step 4/5. Start the Database Service

(!docs/pages/includes/start-teleport.mdx service="the Database Service"!)

The Database Service will discover all Redshift databases according to the configuration
and register them in the cluster. The Database Service will also attempt to configure IAM
access policies for the discovered databases. Keep in mind that AWS IAM changes
may not propagate immediately and can take a few minutes to come into effect.

## Step 5/5. Connect

<ScopedBlock scope={["oss", "enterprise"]}>

Once the Database Service has started and joined the cluster, log in to see the
registered databases. Replace `--proxy` with the address of your Teleport Proxy
Service.

```code
$ tsh login --proxy=teleport.example.com --user=alice
$ tsh db ls
# Name        Description                    Labels
# ----------- ------------------------------ --------
# my-redshift Redshift cluster in us-east-1  ...
```

</ScopedBlock>
<ScopedBlock scope={["cloud"]}>

Once the Database Service has started and joined the cluster, log in to see the
registered databases. Replace `--proxy` with the address of your Teleport Cloud
tenant.

```code
$ tsh login --proxy=mytenant.teleport.sh --user=alice
$ tsh db ls
# Name        Description                    Labels
# ----------- ------------------------------ --------
# my-redshift Redshift cluster in us-east-1  ...
```

</ScopedBlock>

<Admonition type="note" title="Note">
  You can override the database name by applying the `teleport.dev/database_name` AWS tag to the resource. The value of the tag will be used as the database name.
</Admonition>

To retrieve credentials for a database and connect to it:

```code
$ tsh db connect my-redshift
```

You can optionally specify the database name and the user to use by default
when connecting to the database instance:

```code
$ tsh db connect --db-user=awsuser --db-name=dev my-redshift
```

<Admonition type="note" title="Database users must exist">
  Teleport does not currently use the auto-create option when generating
  tokens for Redshift databases. Users must exist in the database.
</Admonition>

To log out of the database and remove credentials:

```code
$ tsh db logout my-redshift
```

## Troubleshooting

(!docs/pages/includes/database-access/aws-troubleshooting.mdx!)

## Next steps

- Learn more about [using IAM authentication to generate database user
  credentials](https://docs.aws.amazon.com/redshift/latest/mgmt/generating-user-credentials.html) for AWS Redshift.
- Learn how to [restrict access](../rbac.mdx) to certain users and databases.
- View the [High Availability (HA)](../guides/ha.mdx) guide.
- Take a look at the YAML configuration [reference](../reference/configuration.mdx).