Connect Amazon Redshift

Amazon Redshift, via the AWS Redshift Data API. Dashies signs each request with SigV4 and never opens a database socket, so there is no host to enter and nothing to allowlist.

Redshift needs two separate credentials

This is the part that differs from every other engine, and it is worth being clear about before you start.

The database login never leaves AWS. Dashies holds a pointer to it and asks the Data API to use it.

Before you start

Do this in AWS:

create user dashies_ro with password 'REPLACE_WITH_A_STRONG_PASSWORD';
grant usage on schema analytics to dashies_ro;
grant select on all tables in schema analytics to dashies_ro;
alter default privileges in schema analytics
  grant select on tables to dashies_ro;

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DashiesDataApi",
      "Effect": "Allow",
      "Action": [
        "redshift-data:ExecuteStatement",
        "redshift-data:DescribeStatement",
        "redshift-data:GetStatementResult",
        "redshift-data:CancelStatement",
        "redshift-data:ListDatabases"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DashiesReadOneSecret",
      "Effect": "Allow",
      "Action": "secretsmanager:GetSecretValue",
      "Resource": "arn:aws:secretsmanager:us-east-1:123456789012:secret:dashies-ro-AbCdEf"
    }
  ]
}

Add the data source

Open dashies.xyz/app/connections, click to add a data source, and pick Amazon Redshift.

Exactly one of workgroup or cluster must be filled in. If both or neither are, the form refuses before anything is sent:

A Redshift data source needs exactly one of a Serverless workgroup or a provisioned cluster.

ARNs from the aws, aws-us-gov, aws-cn, and aws-iso partitions are all accepted.

It verifies in one step

Redshift is a single-step connect. Creating the data source signs one ListDatabases call and comes back active with the databases it found, or error with a class. Up to 200 databases are stored. There is no Resync button on Redshift.

If it fails:

Cost

Connecting is effectively free: the verification is a single ListDatabases metadata call.

Caps

Like the other three API-based engines, Redshift has no byte gate at execution time: nothing on that path measures serialized size. A wide result with few rows is therefore caught one layer later, by the island and body limits above, so do not read the absence of a byte cap as an absence of a ceiling.

Redshift supports every materialization, including Parquet offload for a row-level dataset.

How these ceilings relate to each other, and which one binds first, is in sizes and ceilings.

Dialect notes

Cube SQL is Redshift SQL, which is a PostgreSQL dialect, so almost everything you know from Postgres applies.

• Bucket a date with date_trunc('month', ts)::date, or produce a text bucket with to_char(ts, 'YYYY-MM-DD').

  select date_trunc('month', ordered_at)::date as month,
         sum(amount) as revenue
  from analytics.orders
  group by 1
  order by 1

• Bucket in your business time zone in the SQL. A refresh runs with no session time zone, so a bare date_trunc buckets in UTC.

• Alias letter-case depends on two cluster parameters, not on how you write it. At the defaults, quoting an alias preserves nothing, because AWS folds delimited identifiers to lower case too. Two settings change that: enable_case_sensitive_identifier = true makes a quoted identifier keep its case, and describe_field_name_in_uppercase = on returns every column name in upper case regardless. Neither is exotic.

  Rather than guessing which way your cluster is set, ask your AI tool to run one validation and read the column names back:

  select 1 as MixedCase, 2 as "MixedQuoted"

  That answers both parameters in a single call. A case-only difference between your alias and your declared measure key is handled for you either way; two output columns differing only by case are refused, naming both.

Rotating the key

Edit the data source and paste a new IAM secret access key under Secret access key. Rotating the database user is done in Secrets Manager, and Dashies picks it up without any change here, because it holds only the ARN.

Check it worked

1. The data source reads active on dashies.xyz/app/connections, and lists the databases it discovered.

2. Ask your AI tool to introspect it and run one query:

   Introspect my Redshift data source, then validate this cube SQL against it: select 1 as ok

3. Then author a dashboard against it.