Menu
Amazon Redshift
Management Guide (API Version 2012-12-01)

Amazon Redshift API Permissions Reference

When you are setting up Access Control and writing permissions policies that you can attach to an IAM identity (identity-based policies), you can use the following table as a reference. The table lists each Amazon Redshift API operation, the corresponding actions for which you can grant permissions to perform the action, the AWS resource for which you can grant the permissions, and condition keys that you can include for fine-grained access control (for more information about conditions, see Using IAM Policy Conditions for Fine-Grained Access Control). You specify the actions in the policy's Action field, the resource value in the policy's Resource field, and conditions in the policy's Condition field.

You can use AWS-wide condition keys in your Amazon Redshift policies to express conditions. For a complete list of AWS-wide keys, see Available Keys in the IAM User Guide.

Note

To specify an action, use the redshift: prefix followed by the API operation name (for example, redshift:CreateCluster).

If you see an expand arrow () in the upper-right corner of the table, you can open the table in a new window (to close the window, choose the close button (X) in the lower-right corner).

Amazon Redshift API and Required Permissions for Actions

Amazon Redshift API Operations and Actions Resources Condition Keys

AuthorizeClusterSecurityGroupIngress

redshift:AuthorizeClusterSecurityGroupIngress

Cluster security group

arn:aws:redshift:region:account-id:securitygroup:security-group-name

AuthorizeSnapshotAccess

redshift:AuthorizeSnapshotAccess

Cluster

arn:aws:redshift:region:account-id:cluster:cluster-name

Snapshot

arn:aws:redshift:region:account-id:snapshot:cluster-name/snapshot-name

CopyClusterSnapshot

redshift:CopyClusterSnapshot

Snapshot

arn:aws:redshift:region:account-id:snapshot:cluster-name/source-snapshot-name

arn:aws:redshift:region:account-id:snapshot:cluster-name/target-snapshot-name

CreateCluster

redshift:CreateCluster

Cluster

arn:aws:redshift:region:account-id:cluster:cluster-name

redshift:RequestTag

CreateClusterParameterGroup

redshift:CreateClusterParameterGroup

Parameter group

arn:aws:redshift:region:account-id:parametergroup:parameter-group-name

redshift:RequestTag

CreateClusterSecurityGroup

redshift:CreateClusterSecurityGroup

Cluster security group

arn:aws:redshift:region:account-id:securitygroup:security-group-name

redshift:RequestTag

CreateClusterSnapshot

redshift:CreateClusterSnapshot

Snapshot

arn:aws:redshift:region:account-id:snapshot:cluster-name/snapshot-name

redshift:RequestTag

CreateClusterSubnetGroup

redshift:CreateClusterSubnetGroup

Subnet group

arn:aws:redshift:region:account-id:subnetgroup:subnet-group-name

redshift:RequestTag

CreateEventSubscription

redshift:CreateEventSubscription

Event subscription

arn:aws:redshift:region:account-id:eventsubscription:event-subscription-name

CreateHsmClientCertificate

redshift:CreateHsmClientCertificate

HSM client certificate

arn:aws:redshift:region:account-id:hsmclientcertificate:HSM-client-certificate-id

redshift:RequestTag

CreateHsmConfiguration

redshift:CreateHsmConfiguration

HSM configuration

arn:aws:redshift:region:account-id:hsmconfiguration:HSM-configuration-id

redshift:RequestTag

CreateSnapshotCopyGrant

redshift:CreateSnapshotCopyGrant

Snapshot copy grant

arn:aws:redshift:region:account-id:snapshotcopygrant:snapshot-copy-grant-name

redshift:RequestTag

CreateTags

redshift:CreateTags

Cluster

arn:aws:redshift:region:account-id:cluster:cluster-name

redshift:RequestTag

Cluster security group

arn:aws:redshift:region:account-id:securitygroup:security-group-name

HSM client certificate

arn:aws:redshift:region:account-id:hsmclientcertificate:HSM-client-certificate-id

HSM configuration

arn:aws:redshift:region:account-id:hsmconfiguration:HSM-configuration-id

Parameter group

arn:aws:redshift:region:account-id:parametergroup:parameter-group-name

Snapshot

arn:aws:redshift:region:account-id:snapshot:cluster-name/snapshot-name

Snapshot copy grant

arn:aws:redshift:region:account-id:snapshotcopygrant:snapshot-copy-grant-name

Subnet group

arn:aws:redshift:region:account-id:subnetgroup:subnet-group-name

DeleteCluster

redshift:DeleteCluster

Cluster

arn:aws:redshift:region:account-id:cluster:cluster-name

redshift:ResourceTag

DeleteClusterParameterGroup

redshift:DeleteClusterParameterGroup

Parameter group

arn:aws:redshift:region:account-id:parametergroup:parameter-group-name

redshift:ResourceTag

DeleteClusterSecurityGroup

redshift:DeleteClusterSecurityGroup

Cluster security group

arn:aws:redshift:region:account-id:securitygroup:security-group-name

redshift:ResourceTag

DeleteClusterSnapshot

redshift:DeleteClusterSnapshot

Snapshot

arn:aws:redshift:region:account-id:snapshot:cluster-name/snapshot-name

redshift:ResourceTag

DeleteClusterSubnetGroup

redshift:DeleteClusterSubnetGroup

Subnet group

arn:aws:redshift:region:account-id:subnetgroup:subnet-group-name

redshift:ResourceTag

DeleteEventSubscription

redshift:DeleteEventSubscription

Event subscription

arn:aws:redshift:region:account-id:eventsubscription:event-subscription-name

DeleteHsmClientCertificate

redshift:DeleteHsmClientCertificate

HSM client certificate

arn:aws:redshift:region:account-id:hsmclientcertificate:HSM-client-certificate-id

redshift:ResourceTag

DeleteHsmConfiguration

redshift:DeleteHsmConfiguration

HSM configuration

arn:aws:redshift:region:account-id:hsmconfiguration:HSM-configuration-id

redshift:ResourceTag

DeleteSnapshotCopyGrant

redshift:DeleteSnapshotCopyGrant

Snapshot copy grant

arn:aws:redshift:region:account-id:snapshotcopygrant:snapshot-copy-grant-name

redshift:ResourceTag

DeleteTags

redshift:DeleteTags

Cluster

arn:aws:redshift:region:account-id:cluster:cluster-name

redshift:ResourceTag

Cluster security group

arn:aws:redshift:region:account-id:securitygroup:security-group-name

HSM client certificate

arn:aws:redshift:region:account-id:hsmclientcertificate:HSM-client-certificate-id

HSM configuration

arn:aws:redshift:region:account-id:hsmconfiguration:HSM-configuration-id

Parameter group

arn:aws:redshift:region:account-id:parametergroup:parameter-group-name

Snapshot

arn:aws:redshift:region:account-id:snapshot:cluster-name/snapshot-name

Snapshot copy grant

arn:aws:redshift:region:account-id:snapshotcopygrant:snapshot-copy-grant-name

Subnet group

arn:aws:redshift:region:account-id:subnetgroup:subnet-group-name

DescribeClusterParameterGroups

redshift:DescribeClusterParameterGroups

redshift:ResourceTag

DescribeClusterParameters

redshift:DescribeClusterParameters

Parameter group

arn:aws:redshift:region:account-id:parametergroup:parameter-group-name

DescribeClusters

redshift:DescribeClusters

DescribeClusterSecurityGroups

redshift:DescribeClusterSecurityGroups

DescribeClusterSnapshots

redshift:DescribeClusterSnapshots

DescribeClusterSubnetGroups

redshift:DescribeClusterSubnetGroups

DescribeClusterVersions

redshift:DescribeClusterVersions

DescribeDefaultClusterParameters

redshift:DescribeDefaultClusterParameters

DescribeEventCategories

redshift:DescribeEventCategories

DescribeEvents

redshift:DescribeEvents

DescribeEventSubscriptions

redshift:DescribeEventSubscriptions

DescribeHsmClientCertificates

redshift:DescribeHsmClientCertificates

DescribeHsmConfigurations

redshift:DescribeHsmConfigurations

DescribeLoggingStatus

redshift:DescribeLoggingStatus

DescribeOrderableClusterOptions

redshift:DescribeOrderableClusterOptions

DescribeReservedNodeOfferings

redshift:DescribeReservedNodeOfferings

DescribeReservedNodes

redshift:DescribeReservedNodes

DescribeResize

redshift:DescribeResize

DescribeSnapshotCopyGrants

redshift:DescribeSnapshotCopyGrants

DescribeTableRestoreStatus

redshift:DescribeTableRestoreStatus

DescribeTags

redshift:DescribeTags

DisableLogging

redshift:DisableLogging

Cluster

arn:aws:redshift:region:account-id:cluster:cluster-name

redshift:ResourceTag

DisableSnapshotCopy

redshift:DisableSnapshotCopy

Cluster

arn:aws:redshift:region:account-id:cluster:cluster-name

redshift:ResourceTag

EnableLogging

redshift:EnableLogging

Cluster

arn:aws:redshift:region:account-id:cluster:cluster-name

redshift:ResourceTag

EnableSnapshotCopy

redshift:EnableSnapshotCopy

Cluster

arn:aws:redshift:region:account-id:cluster:cluster-name

redshift:ResourceTag

GetClusterCredentials

redshift:GetClusterCredentials

redshift:CreateClusterUser

redshift:JoinGroup

Cluster

arn:aws:redshift:region:account-id:cluster:cluster-name

redshift:ResourceTag

redshift:DbName

redshift:DbUser

redshift:DurationSeconds

Database

arn:aws:redshift:region:account-id:cluster:cluster-name/database-name

Database user

arn:aws:redshift:region:account-id:cluster:cluster-name/database-user-name

Database group

arn:aws:redshift:region:account-id:cluster:cluster-name/database-group-name

ModifyClusterParameterGroup

redshift:ModifyClusterParameterGroup

Parameter group

arn:aws:redshift:region:account-id:parametergroup:parameter-group-name

redshift:ResourceTag

ModifyClusterSubnetGroup

redshift:ModifyClusterSubnetGroup

Subnet group

arn:aws:redshift:region:account-id:subnetgroup:subnet-group-name

redshift:ResourceTag

ModifyEventSubscription

redshift:ModifyEventSubscription

Event subscription

arn:aws:redshift:region:account-id:eventsubscription:event-subscription-name

redshift:ResourceTag

ModifySnapshotCopyRetentionPeriod

redshift:ModifySnapshotCopyRetentionPeriod

Cluster

arn:aws:redshift:region:account-id:cluster:cluster-name

redshift:ResourceTag

PurchaseReservedNodeOffering

redshift:PurchaseReservedNodeOffering

RebootCluster

redshift:RebootCluster

Cluster

arn:aws:redshift:region:account-id:cluster:cluster-name

redshift:ResourceTag

ResetClusterParameterGroup

redshift:ResetClusterParameterGroup

Parameter group

arn:aws:redshift:region:account-id:parametergroup:parameter-group-name

redshift:ResourceTag

RestoreFromClusterSnapshot

redshift:RestoreFromClusterSnapshot

Cluster

arn:aws:redshift:region:account-id:cluster:target-cluster-name

redshift:ResourceTag

Snapshot

arn:aws:redshift:region:account-id:snapshot:snapshot-cluster-name/snapshot-name

RestoreTableFromClusterSnapshot

redshift:RestoreTableFromClusterSnapshot

Snapshot

arn:aws:redshift:region:account-id:snapshot:cluster-name/snapshot-name

redshift:ResourceTag

RevokeClusterSecurityGroupIngress

redshift:RevokeClusterSecurityGroupIngress

Cluster security group

arn:aws:redshift:region:account-id:securitygroup:security-group-name

redshift:ResourceTag

RevokeSnapshotAccess

redshift:RevokeSnapshotAccess

Snapshot

arn:aws:redshift:region:account-id:snapshot:cluster-name/snapshot-name

redshift:ResourceTag

RotateEncryptionKey

redshift:RotateEncryptionKey

Cluster

arn:aws:redshift:region:account-id:cluster:cluster-name

redshift:ResourceTag

Redshift also supports the following actions that are not based on the Amazon Redshift API:

  • The redshift:ViewQueriesInConsole action controls whether a user can see queries in the Amazon Redshift console in the Queries tab of the Cluster section.

  • The redshift:CancelQuerySession action controls whether a user can terminate running queries and loads from the Cluster section in the Amazon Redshift console.