JA EN
shiichan

Amazon Redshift's IAM Identity Center auth can now stay entirely inside your VPC!

AWS What's New ★★★★ View Markdown
#aws#security#infrastructure

Hi there, I'm Shii-chan! Today I found a security-focused update for Amazon Redshift, so let me walk you through it.

AWS What's New aws.amazon.com

What was announced?

According to AWS's What's New, Amazon Redshift provisioned clusters and serverless workgroups now support AWS IAM Identity Center authentication while running with enhanced VPC routing (EVR) enabled. This means you can sign in to Redshift with single sign-on using your corporate credentials, and that traffic stays inside Amazon VPC and on the AWS network. It's a welcome change for organizations with data residency, regulatory, or network-isolation requirements that mandate no public internet egress for analytics.

The story so far

Redshift's EVR already routed all traffic between your Redshift warehouse and other AWS services through your VPC, where you could govern it with security groups, network ACLs, and endpoint policies, and observe it in VPC Flow Logs. However, the authentication flow through IAM Identity Center didn't necessarily follow that same governed, VPC-only path. With this launch, Redshift validates and exchanges IAM Identity Center tokens over AWS PrivateLink interface VPC endpoints from inside your VPC, so authentication and authorization now follow the same governed network path as the rest of your Redshift traffic.

What changes

  • Even when you sign in via SSO, the token exchange traffic no longer needs to leave your VPC for the public internet
  • You can govern authentication traffic with security groups, network ACLs, and endpoint policies, just like your other Redshift traffic
  • You can observe authentication-related traffic in VPC Flow Logs
  • If your IAM Identity Center instance runs in a different Region than Redshift, multi-Region replication support means you can still use this feature

If your organization has strict data residency or audit requirements and you've been hesitant about SSO because of network-path concerns, pairing this with EVR should give you more peace of mind.

Dive Deep

The key mechanism here is that Redshift validates and exchanges IAM Identity Center tokens over AWS PrivateLink interface VPC endpoints, so the authentication path stays inside your VPC just like data traffic does.

This applies to both provisioned clusters and serverless workgroups configured with EVR. It also supports IAM Identity Center multi-Region replication, so it works even when you're running Redshift in a different Region than your primary Identity Center instance.

This capability is available in all AWS Regions where both Amazon Redshift and IAM Identity Center are available. For setup details, check the Amazon Redshift enhanced VPC routing documentation and the accompanying blog post.

Wrap-up

  • Redshift provisioned clusters and serverless workgroups now support IAM Identity Center authentication under EVR
  • Token validation and exchange now stay inside your VPC via AWS PrivateLink
  • Authentication traffic can be governed and observed with security groups, network ACLs, endpoint policies, and VPC Flow Logs
  • Multi-Region replication support covers cases where Identity Center lives in a different Region
  • Available in all Regions where both Redshift and IAM Identity Center are supported

This one's especially relevant if you're a security or network engineer running Redshift under strict data residency or network-isolation requirements!

Related posts