> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Amazon Redshift Data API
> Use a cross-account IAM role so Iru Compliance can read Redshift Data API statement and schema metadata for clusters and serverless workgroups.
### About Amazon Redshift Data API
The **Data API** exposes **statement**, **database**, **schema**, and **table** listings without JDBC shells. Iru needs **`redshift-data:`** read actions plus **`redshift:DescribeClusters`** for provisioned clusters and **`redshift-serverless:List*`** helpers when workgroups are in scope. **`AmazonRedshiftDataFullAccess`** is convenient but includes **`ExecuteStatement`**; prefer the **inline** policy below for least privilege.
### How It Works
Iru runs in its own AWS account. To call the **Redshift Data API** on your behalf, you create an **IAM role** in your AWS account with two parts: a **trust policy** that allows Iru’s principal to call **`sts:AssumeRole`**, gated by the **External ID** from the wizard, and a **permissions policy** with read-only **`redshift-data:`** actions (plus the supporting **`redshift:`** / **`redshift-serverless:`** calls the connector needs, as in the inline example on the [**AWS**](#aws) tab). You then paste the role’s **ARN** back into Iru.
| Detail | Value |
| ------------------ | ---------------------- |
| **Category** | Databases |
| **Authentication** | Cross-account IAM role |
### Prerequisites
* IAM rights to **create roles** in the account that owns Redshift resources.
### Connect Amazon Redshift Data to Iru
Start here: open the source wizard and copy the **trust policy** (and note the **external ID**). When you are ready to create the role in AWS, switch to the [**AWS**](#aws) tab and follow [**Create the IAM role**](#create-the-iam-role). After you have the **Role ARN**, return to the [**Iru Compliance**](#iru-compliance) tab and complete [**Submit the role ARN in Iru**](#submit-the-role-arn-in-iru) below.
#### Get the trust policy from Iru
In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.
Find **Amazon Redshift Data** (use **Category** or **Search by name or description**). On that card, turn on the **toggle**. Leave the **Iru is requesting access to external services** wizard tab open.
The wizard shows the **trust policy** JSON your IAM role must use (**Principal** and **sts:ExternalId**). Below is an **example** of the structure; **copy the live JSON from your wizard** so the account, principal ARN, and external ID match exactly.
```json copy=false lines theme={null}
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::753695775620:role/IruConnect"
},
"Condition": {
"StringEquals": {
"sts:ExternalId": "YOUR_EXTERNAL_ID"
}
},
"Action": "sts:AssumeRole"
}
]
}
```
Keep the Iru wizard tab open for reference, then switch to the [**AWS**](#aws) tab and follow [**Create the IAM role**](#create-the-iam-role).
#### Submit the role ARN in Iru
Finish the [**AWS**](#aws) tab first (through [**Create the IAM role**](#create-the-iam-role)) so you have the **Role ARN** from the new role.
Return to the Iru wizard tab. Paste the **Role ARN** where the connector prompts for it.
Click **Submit Role**. When the connection succeeds, the wizard shows **Connection Configured**.
Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **Amazon Redshift Data** card is **Active**.
Complete [**Get the trust policy from Iru**](#get-the-trust-policy-from-iru) on the [**Iru Compliance**](#iru-compliance) tab before you create this role. Use the **external ID** and trust policy from the live wizard when you configure **Trusted entity**.
#### Create the IAM role
Open **IAM** → **Roles** → **Create role**.
Choose **AWS account** → **Another AWS account**. Enter **`753695775620`** (or the ID Iru shows). Enable **Require external ID** and paste the external ID from Iru.
Attach an **inline policy** (recommended over **`AmazonRedshiftDataFullAccess`** for least privilege). The JSON below is an **example** of the permissions shape; adjust if your security team requires fewer actions.
```json lines theme={null}
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"redshift-data:DescribeStatement",
"redshift-data:DescribeTable",
"redshift-data:GetStatementResult",
"redshift-data:ListDatabases",
"redshift-data:ListSchemas",
"redshift-data:ListStatements",
"redshift-data:ListTables"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"redshift:DescribeClusters",
"redshift-serverless:ListNamespaces",
"redshift-serverless:ListWorkgroups"
],
"Resource": "*"
}
]
}
```
Name the role, create it, and copy the **Role ARN**. Switch back to the [**Iru Compliance**](#iru-compliance) tab and complete [**Submit the role ARN in Iru**](#submit-the-role-arn-in-iru).
Continue on the [**Iru Compliance**](#iru-compliance) tab to paste the **Role ARN** and finish the wizard ([**Submit the role ARN in Iru**](#submit-the-role-arn-in-iru)).
### Troubleshooting
Check **pop-up blocker** settings for the Iru site and try again.
Required when resolving **cluster IDs** - add the **`redshift:`** statement block.
Extend with **`redshift-serverless:Get*`** per **[Amazon Redshift Serverless](/en/compliance/sources/amazon-redshift-serverless-source)**.
External ID mismatch.
### Related Articles
Connect and manage the related source in Compliance.
Connect and manage the related source in Compliance.
Browse and manage every Compliance source.
Frameworks, actions, and **Artifacts**.