​

Before you connect

• CONNECT on the database
• USAGE on the target schema(s)
• SELECT on the tables you want to expose

​

Connection fields

SSL — Supaboard always uses SSL when connecting to Redshift. No toggle is needed.

​

SSH Tunnel fields

​

Finding your connection details

​

Amazon Redshift Console

1. Open the Redshift Console and go to Clusters.
2. Select your cluster.
3. Under General information, copy the Endpoint — it looks like:
   cluster-name.xxxxxxxxxx.region.redshift.amazonaws.com:5439/database
   
4. Use the hostname part (before the colon) as Host, 5439 as Port, and the database name (after the final /) as Database.

1. In the Redshift Console, go to Serverless dashboard.
2. Select your workgroup.
3. Under Workgroup details, copy the Endpoint — it looks like:
   workgroup-name.accountid.region.redshift-serverless.amazonaws.com:5439/database
   
4. Parse the same way as provisioned clusters above.

1. On the cluster or workgroup detail page, find the VPC security group.
2. Open the security group in the EC2 Console.
3. Add an inbound rule: Type = Custom TCP, Port = 5439, Source = each Supaboard egress IP (as /32 CIDR rules).

​

SSH Tunnel

• Cluster is not publicly accessible (most production configurations)
• Security policy requires all external traffic to pass through a bastion host

• The bastion host is in the same VPC as the Redshift cluster
• The bastion host’s security group allows SSH (port 22) from Supaboard egress IPs
• The Redshift cluster’s security group allows port 5439 from the bastion host’s security group
• The SSH user has permission to forward connections
• If using a private key, it is in PEM format

​

IPsec Site-to-Site VPN

• Your VPN gateway has one IKEv2 + pre-shared-key tunnel per Supaboard IP (the IPs shown under Whitelist IPs)
• The gateway allows UDP 500, UDP 4500, and ESP (IP protocol 50) from those IPs
• The Host field is the database’s private IP address — private DNS names don’t resolve from Supaboard
• Enter the database name manually — auto-discovery doesn’t run through the VPN before the connection is saved

​

Recommended database user permissions

-- Create a dedicated read-only user
CREATE USER supaboard WITH PASSWORD 'strong_password_here';

-- Grant connect on the database (run as superuser)
GRANT CONNECT ON DATABASE your_database TO supaboard;

-- Grant schema access
GRANT USAGE ON SCHEMA public TO supaboard;

-- Grant table access
GRANT SELECT ON ALL TABLES IN SCHEMA public TO supaboard;

-- Grant access to future tables
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT SELECT ON TABLES TO supaboard;

​

Troubleshooting